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PREFACE 


This  report  documents  research  conducted  as  a public  service  by 
Rand  using  its  own  funds.  The  report  draws  upon  recent  Rand  research 
conducted  for  and  reported  to  the  Air  Force.  That  research  has  re- 
vealed several  methodological  deficiencies  in  the  current  engineering 
procedures  for  evaluating  the  structural  modifications  required  to 
extend  an  airframe's  service  life.  To  help  fill  this  gap  in  engineer- 
ing analysis  procedures,  Rand  initiated  a Fatigue  Failure  Analysis 
project.  This  report  documents  the  results  of  that  project. 

The  findings  discussed  here  should  interest  organizations  that 
manufacture,  operate,  or  regulate  aircraft  and  other  structures  with 
elements  that  are  prone  to  fatigue  failure.  The  findings  should  par- 
ticularly interest  organizations  responsible  for  transport  aircraft, 
because  a transport  serves  as  the  basis  for  the  example  application. 
The  Federal  Aviation  Administration  (FAA)  and  the  U.S.  Air  Force  may 
wish  to  consider  encouraging  the  use  of  this  approach  to  enhance  the 
fail  safety  features  of  new  designs,  and  to  improve  the  effectiveness 
of  maintenance  actions  intended  to  reduce  the  chances  of  inflight 
structural  failures.  Recently,  the  FAA  proposed  a rule  change  that 
should  allow  manufacturers  of  commercial  transports  to  use  this 
approach. 

Professor  Paul  Paris  is  a consultant  to  Rand's  Engineering  and 
Applied  Sciences  Department. 


'Transport  Category  Airplane  Fatigue  Regulatory  Review  Program, 
Fatigue  Proposals,"  Federal  Aviation  Administration,  14  CFR , Part  25, 
Docket  No.  16280;  Notice  No.  77-15,  appeared  in  Federal  Register , Vol 
42,  No.  157,  August  15,  1977. 
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SUMMARY 


The  undetected  propagation  of  a fatigue  crack  constitutes  a signif- 
icant cause  of  aircraft  and  other  structural  failures.  Although  frac- 
ture mechanics  methods  can  generally  predict  how  fast  a given  crack  will 
propagate  through  an  element  in  a metal  airframe,  so  far  no  method  can 
adequately  predict  when  cracks  will  start  because  of  design,  manufactur- 
ing, maintenance,  or  operational  anomalies.  Moreover,  in  many  relevant 
situations,  reliable  information  does  not  exist  for  the  probability  that 
inspection  procedures  will  locate  a crack.  When  such  detection  does  not 
occur,  an  applied  load  eventually  causes  the  cracked  element  to  fail, 
and  if  large  enough,  also  causes  the  structure  to  collapse.  To  raise 
this  structural  failure  load  to  a relatively  high  level,  the  manufac- 
turer can  divide  the  structure  into  many  small  elements,  which  signifi- 
cantly increases  the  ability  of  a structure  to  tolerate  an  element 
failure.  Until  now,  however,  a credible  and  generally  meaningful  pro- 
cedure for  assessing  this  benefit  has  not  existed.  This  report  presents 
the  basic  equations  for  such  a procedure. 

The  proposed  procedure  calculates  the  probability  that  the  unde- 
tected propagation  of  a given  fatigue  crack  in  an  element  will  not  lead 
to  a structural  failure.  It  also  provides  the  probability  that  the 
element  has  not  failed,  as  a function  of  the  c rack  propagation  time  and 
hence  the  crack's  length.  It  requires  information  about: 

o The  time-varying  distribution  of  applied  loads, 

o How  fast  cumulative  operations  cause  the  crack's  size  to 
enlarge, 

o How  the  crack's  size  influences  the  element's  remaining 
strength,  and 

o The  applied  load  required  to  fail  the  structure  once  the 
cracked  element  has  failed. 


1 


This  procedure  does  not  use  estimates  of  how  and  when  a crack 
starts.  Nor  does  it  require  the  definition  of  a specific  maximum  load 
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condition  that  a fatigue  damaged  structure  must  tolerate.  However,  it 
does  require  the  assumption  that  an  element  failure  will  not  go  un- 
noticed if  the  aircraft  survives  the  flight  during  which  the  element 
fails . 

The  procedure  has  a form  so  simple  that  computations  with  a desk 
calculator  can  yield  reasonably  accurate  results.  To  illustrate  this, 
the  report  uses  data  that  an  aircraft  manufacturer  developed  for  the 
structural  components/elements  that  currently  limit  the  service  life 
of  an  existing  transport  aircraft.  To  be  safe,  the  operator  imposed 
the  current  service  limit  based  on  a reasonably  conservative  assumption 
that  a crack  as  large  as  .05  inch  may  have  existed  in  a wing  component 
during  fabrication.  Based  on  the  manufacturer's  fracture  mechanics 
calculations,  the  operator  estimated  that  it  should  take  only  about 
8000  flight  hours  for  such  a crack  to  propagate  to  a length  where  a 
limit  load  would  cause  a component  failure.  In  the  event  that  two 
adjoining  components  failed  because  the  adjoining  component  also  con- 
tained a crack,  the  operator  surmised  that  the  structure  would  probably 
fail  because  the  manufacturer  had  not  intentionally  designed  the  struc- 
ture to  withstand  a dual  component  failure.  Thus,  the  operator  imposed 
the  current  limit  of  8000  hours.  The  example  calculation  yields  a 
97.4  percent  probability  that  even  such  a dual  component  failure  should 
not  cause  a structural  failure.  Moreover,  if  the  adjoining  component 
does  not  contain  a significant  strength  degrading  crack,  the  probability 
increases  to  99.9  percent  because  the  stresses  near  the  failure  site 
have  a 30  percent  lower  intensity  with  the  single  component  failure  than 
with  the  double  component  failure. 

This  calculated  capability  to  tolerate  single  and  dual  component 
failures  does  not  necessarily  extend  to  the  other  types  of  aircraft  that 
the  operator  uses.  For  example,  compared  with  the  example  aircraft, 
some  of  the  other  aircraft  experience  higher  stress  levels  and  have  far 
fewer  components  comprising  the  structure  of  the  wing's  lower  surface. 
Moreover,  whereas  some  aircraft  have  significant  load-carrying  compo- 
nents buried  inside  the  wing's  lower  surface,  this  does  not  occur  with 
the  example  aircraft.  Thus,  because  the  manufacturer  of  the  example 
aircraft  has  divided  the  lower  surface  structure  into  eleven  distinct 
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components,  each  clearly  visible  from  outside  the  aircraft,  that  air- 
craft has  a significant  capability  to  survive  either  a single  or  dual 
component  failure. 

An  application  of  this  calculation  procedure  to  both  the  single 
component  and  the  dual  component  failure  scenarios  for  other  aircraft 
should  provide  the  operator  with  new  and  significant  comparative  in- 
sights into  the  priorities  for  structural  modifications  designed  to 
extend  the  service  lives  of  various  aircraft. 

The  example  also  shows  that  98  percent  of  the  component  failures 
considered  in  the  example  aircraft  should  occur  after  the  postulated 
crack  has  grown  from  underneath  a lap  joint.  Although  this  should 
significantly  increase  the  chances  that  detection  of  the  crack  might 
avert  a component  failure,  the  previously  stated  probabilities  have 
not  accounted  for  such  a possibility. 

The  procedure  generally  does  not  apply  to  situations  where  a 
large  number  of  strength  degrading  fatigue  cracks  have  developed  over 
a wide  area,  or  prompt  detection  of  a failed  element  would  not  occur, 
or  the  nature  of  the  structure  or  its  operating  environment  makes  the 
preparation  of  the  inputs  impractical. 

For  many  situations,  however,  the  procedure  should  help  manufac- 
turers and  operators  to  more  systematically  identify  and  prioritize 
failure  critical  components.  Thus,  we  recommend  that  manufacturers 
and  operators  adopt  such  a probabilistic  procedure  to 

1.  Help  evaluate  the  need  for  major  structural  modification 
programs . 

2.  Augment  current  service  life  assessment  procedures. 

3.  Inform  management  about  a structure's  damage  tolerance 
capability  throughout  the  structure's  life  cycle — from 
initial  design  through  final  retirement. 
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SYMBOLS 


= crack  length  at  time  t;  in  inches. 


f = factor  including  the  influence  of  second  order  terms. 

i,  j,  k = indexes  identifying  operating  intervals. 

n(o)  = number  of  times  that  the  maximum  load  intensity  per  operat- 
ing interval  exceeds  0 during  one  design  lifetime  containing 
t^  flying  hours. 


Pef ^t0,ti^ 
Pnef (t0’ti) 


Pnsf<tO*ti) 


Psf 

ref(0 


rsf(t) 


1 " Pnef ^t0,ti^ * 

= probability  that  the  postulated  crack  condition  does  not 
fail  the  element  at  any  time  during  the  interval  (tg.t^). 

= probability  that  the  postulated  crack  condition  does  not 
contribute  to  a structural  failure  at  any  time  during  the 
interval  (tg.t^. 

1 “ Pnsf(t0,t:i)- 

= expected  rate  at  which  the  maximum  load  intensity  per 
operating  interval  exceeds  the  element  failure  stress 
(Oef ) ; occurrences  per  unit  of  operating  time  at  time  t. 

= expected  rate  at  which  the  maximum  load  intensity  per 
operating  interval  exceeds  the  structural  failure  stress 
(a  j) ; occurrences  per  unit  of  operating  time  at  time  t. 

= cumulative  operating  time  measured  in  flying  hours, 
tj,  = time  when  the  i th  operating  interval  ends, 
tj  = design  lifetime;  basis  for  the  function  n(a) . 
t = midpoint  of  calculation  interval  a. 

At  = length  of  the  operating  interval. 


t = time  when  the  minimum  load  intensity  level  that  can 

fail  an  element  equals  the  residual  strength  of  the 

structure  once  the  element  has  failed  (c  ). 

rs 

= arbitrary  function. 

= indexes  identifying  calculation  intervals. 
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0 = intensity  of  the  internal  structural  loads  that  the 
applied  loads  would  cause  in  an  idealized  structure 
that  does  not  contain  any  holes,  cutouts,  or  cracks 
(e.g.,  gross  area  stress);  measured  at  the  location  of 
the  postulated  crack;  in  Ksi  (1  Ksi  = 1000  psi) . 

0 (t^)  = maximum  load  intensity  for  the  i th  operating 
interval. 

ae^(a)  = minimum  load  intensity  level  at  which  a crack 
of  length  a can  fail  a given  element. 

0 ^(a)  = minimum  load  intensity  level  at  which  a crack 
of  length  a can  contribute  to  a structural 
failure. 

Org  = remaining  strength  of  the  structure  when  the 

element  containing  the  postulated  crack  fails. 

T = dummy  variable  for  the  time  t. 
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I . INTRODUCTION 


The  strength  capability  of  an  aircraft  structure  frequently  de- 
clines with  service  use  because  the  repeated  loading  and  unloading  of 
the  structure  causes  the  spawning  and  enlargement  of  fatigue  cracks 
that  progressively  weaken  the  structure.  If  undetected,  a fatigue 
crack  will  usually  enlarge  to  a size  where  the  loads  applied  during  a 
flight  will  cause  the  element  containing  the  crack  to  fail.  If  ad- 
joining elements  cannot  pick  up  the  internal  structural  loads  carried 
by  the  failed  element  and  transmit  them  around  the  failure  site,  the 
failure  advances  into  these  elements  as  well,  and  the  total  load  that 
the  remaining  unfailed  elements  must  pick  up  and  redistribute  around 
the  failure  site  is  increased.  If  the  remaining  elements  cannot  stop 
the  progression  of  the  failure,  this  portion  of  the  structure  collapses, 
thereby  causing  a structural  failure.  Because  an  accident,  usually 
involving  fatalities,  occurs  when  a major  portion  of  an  aircraft  struc- 
ture collapses  during  flight,  such  an  incident  is  usually  referred  to 
as  a catastrophic  structural  failure.^ 

This  report  develops  a set  of  simple  formulas  for  calculating  the 
probability  that  a structural  failure  will  not  occur  even  though  a 
postulated  fatigue  crack  propagates  through  an  element  without  being 
detected.  The  formulas  require  information  on  crack  propagation  and 
strength  degradation,  along  with  a distribution  to  represent  how  often 
the  applied  structural  loads  exceed  specified  levels. 

Section  II  describes  the  approach,  the  assumptions,  and  the  in- 
puts. Although  the  approach  is  applied  chiefly  to  reducing  the  chances 
that  an  aircraft  will  experience  a catastrophic  structural  failure,  it 
has  potential  applicability  to  other  kinds  of  structures  (e.g.,  pres- 
sure vessels).  To  facilitate  its  application  to  related  problems. 

Sec.  Ill  provides  a general  development  of  the  basic  equations.  Sec- 
tion IV  applies  the  approach  to  a transport  aircraft  wing,  and  Sec.  V 
presents  observations  and  recommendations.  Appendixes  A through  I 
furnish  additional  details. 


See  Appendix  A for  some  recent  examples. 
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CURRENT  APPROACHES 

Even  though  the  possibility  of  a catastrophic  structural  failure 
will  always  exist  during  every  flight  of  every  manned  aircraft,  the 
aircraft's  manufacturer  and  operator  can  in  theory  use  available  re- 
sources to  minimize  the  probability  that  it  will  occur.  To  accomplish 
this,  two  distinct  design  philosophies  have  evolved: 

1.  The  fail-safe  philosophy  holds  that,  an  aircraft  structure 
should  have  enough  independent  elements  to  provide  assurance 
that  for  a specified  applied  load,  the  failure  of  any  single 
element  will  not  lead  to  a catastrophic  structural  failure. 

2.  The  safe-life  philosophy  holds  that  the  specified  operating 
life  for  an  aircraft  structure  should  not  exceed  the  time 
required  for  a specified  initial  crack  to  propagate  to  a 
length  (referred  to  as  the  critical  length)  at  which  a spe- 
cified applied  load  would  cause  the  element  containing  the 
crack  to  fail  (Refs.  1 and  2). 

Although  each  yields  some  desirable  design  features,  both  phil- 
osophies have  certain  limitations  that  need  not  afflict  a probabilistic 
approach. ^ For  example,  both  require  the  specification  of  an  applied 
design  load.  But  no  matter  how  large  a design  load  the  operator  spe- 
cifies, there  is  still  the  possibility  that  an  even  larger  load  may 
occur.  Also,  no  matter  how  large  an  initial  crack  size  the  operator 
specifies  for  a safe-life  approach,  an  even  more  severe  condition  may 
arise . 

Aircraft  manufacturers  and  operators  currently  use  fixed  extreme 
values  for  the  design  load  and  the  initial  crack  size.  Although  such 
values  may  reflect  the  best  judgment  of  the  most  knowledgeable  indi- 
viduals, neither  the  manufacturer's  nor  the  operator's  management  can 
relate  the  subjective  basis  for  such  assessments  to  an  understanding 
of  the  likelihood  that  a postulated  fatigue  crack  may  cause  a catas- 
trophic structural  failure.  Tlius  managers  have  difficulty  finding  a 

^See  Appendix  B for  additional  discussion. 
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consistent  basis  for  allocating  resources  to  reduce  uniformly  the 
chances  that  a catastrophic  structural  failure  will  result  from  an 
element  failure  in  an  aircraft  structure. 

A PROBABILISTIC  APPROACH 

This  report  proposes  a probabilistic  approach  that  avoids  the 
extreme  value  judgments  mentioned  above  and  supplements  the  informa- 
tion provided  by  the  safe-life  and  fail-safe  approaches.  This  prob- 
abilistic approach,  which  accepts  the  existence  of  the  crack  as  a 
given  and  uses  a distribution  to  represent  the  applied  loads,  has  the 
following  unique  features: 

o The  approach  requires  no  knowledge  of  what  causes  a crack  to 
start  or  of  how  fast  the  crack  propagates  during  its  initial 
phase  of  development. 

o Once  the  crack  has  reached  a size  where  it  begins  to  contri- 
bute to  the  calculated  probabilities,  the  approach  accurately 
represents  the  crack  propagation  history  calculated  by  frac- 
ture mechanics  methods. 

Potential  Application 

When  this  probabilistic  approach  has  been  applied  to  various 
elements,  they  can  then  be  ranked  according  to  the  likelihood  that 
their  failure  would  lead  to  a structural  failure.  The  most  failure- 
aritiaal  elements  constitute  candidates  for  either  redesign  or  special 
maintenance  attention,  such  as  more  frequent  inspections.  In  some 
cases,  a special  rework  or  even  replacement  of  the  element  may  be 
warranted. 

Such  a procedure  for  consistently  quantifying  a structure's 
ability  to  tolerate  undetected  fatigue  cracks  may  help  manufacturers 
and  operators  to  apply  their  available  resources  more  effectively. 

For  example,  during  the  design  and  manufacturing  phase,  such  a pro- 
cedure can  (1)  help  identify  the  most  failure-critical  elements  in  a 
given  design;  (2)  provide  a basis  for  design  and  manufacturing  standards 
and  (3)  give  managers  an  opportunity  to  see  how  design  tradeoffs  may 
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influence  the  chances  of  structural  failure.  During  the  operating 
phase,  such  a procedure  can  (1)  help  reassess  the  most  failure-critical 
elements  based  on  actual  operating  conditions;  (2)  provide  a basis  for 
an  inspection  and  modification  standard;  and  (3)  give  managers/ 
regulators  an  opportunity  to  see  how  inspection  and  modification  trade- 
offs may  influence  the  chances  of  structural  failure. 

Although  the  approach  can  be  applied  to  structures  other  than  air- 
craft, it  does  not  apply  to  situations  where  (1)  a large  number  of 
fatigue  cracks  may  have  weakened  a structure  over  a broad  general  area; 
or  (2)  prompt  detection  of  a failed  element  would  not  occur;  or  (3)  the 
nature  of  the  structure  or  its  operating  environment  makes  the  prepar- 
ation of  inputs  impractical. 

An  Example  Application 

Say  an  aircraft  operator  has  established  a structural  modification 
schedule  based  on  a postulated  crack  condition  that  extends  to  two 
overlapping  components.  He  could  use  the  probabilistic  approach  pro- 
posed here  to  reevaluate  the  necessity  and  effectiveness  of  the  pro- 
posed modification  and  to  examine  how  alternative  actions  could  influence 
the  probability  of  a structural  failure.  He  might  consider  not  making 
the  modification  or  he  might  substitute  an  inspection  program.  He 
might  also  examine  components  not  included  in  the  proposed  modification 
or  apply  the  approach  to  similar  components  in  other  transport  aircraft. 
To  illustrate  the  method's  application,  this  report  uses  actual  data 
for  the  same  postulated  crack  condition  that  the  operator  has  used  to 
set  up  the  modification  schedule. 
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II.  BASIC  CONCEPTS,  INPUTS,  AND  ASSUMPTIONS 


A human  error  during  design,  manufacture,  operation,  or  mainte- 
nance, or  a mechanical  malfunction  can  create  conditions  that  spawn  a 
fatigue  crack  in  a structural  element.  Although  current  engineering 
procedures  cannot  reliably  predict  how  often  such  an  event  may  occur, 
they  can  model  what  happens  once  a fatigue  crack  has  developed.  Un- 
less detected,  and  depending  on  the  geometry,  continuing  operation  of 
the  structure  will  cause  the  crack  to  enlarge  to  a size  where  it 
eventually  weakens  the  element  and  causes  it  to  fail.  This  will  not 
lead  to  failure  of  the  structure,  however,  if  the  following  set  of 
conditions  is  satisfied: 

1.  The  applied  loads  that  occur  after  the  element  has  failed  do 
not  exceed  the  remaining  strength  of  the  structure  at  the 
time  the  element  failed. 

2.  The  remaining  duration  of  the  flight,  during  which  the  ele- 
ment failure  occurred,  does  not  provide  enough  time  to  spawn 
an  additional  fatigue  crack  that  enlarges  to  a size  where  it 
significantly  weakens  an  adjoining  element. 

3.  A fully  effective  replacement/repair  of  the  failed  element 
occurs  before  a fatigue  crack  weakens  an  adjoining  element 
(e.g.,  the  repair  occurs  after  the  flight  during  which  the 
element  failed). 

For  situations  where  conditions  (2)  and  (3)  hold,  this  report 
provides  equations  for  calculating  the  probability  that  a postulated 
crack  condition  will  not  lead  to  a structural  failure. 

BASIC  CONCEPTS 

The  actual  probability  that  a crack  will  eventually  lead  to  a 
structural  failure  depends  on  the  factors  explicitly  represented  in 
this  approach,  as  well  as  on  other  factors  suppressed  by  assumptions. 
If  these  suppressed  factors  have  a negligible  influence  on  the  actual 
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probability,  then  the  predicted  probability  calculated  with  this 
method  should  provide  a close  approximation  to  the  actual  probability. 

* 

Even  if  some  suppressed  factors  have  a significant  influence  that  can 
be  treated  separately,  the  value  calculated  for  the  predicted  proba- 
bility may  still  satisfactorily  quantify  the  influence  of  the  factors 
that  the  model  represents.  Although  this  report  refers  to  the  pre- 
dicted probability  as  simply  the  probability , the  user  must  always 
ascertain  for  himself  the  extent  to  which  this  probability  approximates 
the  actual  probability. 

The  Idealized  Representation  of  the  Failure  Process 

An  element  will  fail  when  the  intensity  of  the  internal  structural 
loads  (referred  to  here  as  simply  load  intensity , a)  exceeds  the  ele- 
ment's remaining  strength.  But  such  a failure  will  not  extend  to  ad- 
joining elements  as  long  as  the  load  intensity  does  not  exceed  the 
remaining  strength  of  the  elements  adjoining  the  failure  site. 

Once  a fatigue  crack  enlarges  to  a size  where  it  first  begins  to 
weaken  the  element,  any  additional  enlargement  reduces  the  remaining 
strength  of  that  element.  As  the  remaining  strength  of  an  element 
decreases,  the  minimum  load  intensity  that  can  cause  the  element  to 
fail  (°ef)  decreases  (e.g.,  see  Fig.  1).  Thus  in  some  situations  an 
element  may  not  fail  until  the  crack  is  large  enough  to  cause  an  appre- 
ciable degradation  in  the  element's  remaining  strength.  In  that  case, 
the  load  intensity  level  that  causes  the  element  to  fail  may  not  exceed 
the  level  required  to  also  cause  the  adjoining  elements  to  fail.  In 
such  an  event,  the  element  fails  (ef)  but  no  structural  failure  (nsf) 
occurs.  For  such  a "safe"  (or  "noncatastrophic")  element  failure  to 
occur  during  a specific  operating  interval  (e.g.,  during  one  flight 
of  an  aircraft) : 

1.  The  element  must  not  have  failed  during  a prior  operating 
interval,  and 

2.  During  the  designated  operating  interval 

a.  At  some  time  the  load  intensity  must  exceed  the  minimum 
level  required  to  fail  the  cracked  element,  and 


1 


b.  At  no  time  following  the  element  failure  can  the  load 
intensity  exceed  the  minimum  level  required  to  fail  the 
remaining  structure  once  the  element  of  interest  has 
failed. 

The  remaining  or  residual  strength  of  the  structure,  once  the  element 
has  failed  (a  ) , depends  on  the  failure  mode  postulated  for  the  struc- 
ture as  well  as  the  condition  of  adjoining  elements. 

Because  the  crack  of  interest  will  enlarge  and  the  remaining 
strength  of  the  element  containing  the  crack  will  decrease  during 
successive  operating  intervals,  our  probabilistic  approach  must  ex- 
plicitly represent  the  process  whereby  the  crack  enlarges  as  the 
structure  accumulates  operating  time.  It  must  also  account  for  the 
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process  whereby  crack  enlargement  reduces  the  element's  remaining 
strength.  Our  approach  represents  both  of  these  processes  with  deter- 
ministic relationships.  It  also  uses  a deterministic  input  to  repre- 
sent the  load  intensity  level  at  which  structural  failure  can  occur, 
once  the  element  containing  the  crack  has  failed.  Because  load  inten- 
sity levels  vary  widely  during  the  operation  of  such  structures — 
especially  aircraft  structures — this  approach  uses  a distribution  to 
represent  the  load  intensity. 

Definition  of  an  Element 

The  element  of  interest  is  defined  as  any  portion  of  the  structure 
that  has  two  boundaries  that  can  arrest  the  propagation  of  a failure. 
Thus,  the  term  element  may  refer  to  one  or  more  structural  members. 

For  example,  the  postulated  crack  condition  might  extend  to  two  over- 
lapping structural  members  at  a common  fastener  hole,  where  cracks 
could  presumably  develop  in  both  members.  Because  the  member  with 
the  shorter  crack  may  not  have  enough  remaining  strength  to  confine 
the  failure  to  the  other  member,  it  might  be  assumed  that  the  failure 
of  one  member  automatically  means  that  the  other  member  will  fail  also. 
In  this  case,  the  two  members  together  would  constitute  the  element  of 
interest.  The  element  concept  may  also  apply  to  the  portion  of  a panel 
between  two  supporting  members  (e.g. , stringers  or  frames)  if  those 
members  might  stop  further  propagation  of  the  crack. 

DESCRIPTION  OF  INPUTS1 

As  an  illustrative  example,  this  report  applies  the  approach  to 
actual  data  obtained  for  a two-panel  element  that  forms  part  of  a wing's 
lower  surface.  For  this  element  of  interest,  the  calculation  procedure 
requires  four  basic  pieces  of  information:  (1)  how  often  does  the  load 
intensity  exceed  various  levels  (e.g.,  Fig.  2);  (2)  how  does  the  crack 
length  influence  the  minimum  load  intensity  that  can  fail  the  element 
(e.g..  Fig.  3);  (3)  how  does  the  crack  length  change  over  time  (e.g., 

* Appendix  D discusses  how  the  airframe  manufacturer  typically 
prepares  the  information  required  by  this  approach.  Appendix  E de- 
scribes how  the  inputs  influence  the  results. 
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Fig.  4);  and  (4)  the  remaining  strength  of  the  structure,  once  the 
element  of  interest  has  failed  (expressed  as  a load  intensity,  °rs) • 
Because  this  information  can  vary  for  different  locations,  the  discus- 
sion in  this  subsection  applies  only  to  the  specific  crack  or  cracks 
that  are  presumed  to  exist  in  the  element  of  interest.  The  remaining 
inputs  include  the  average  length  of  the  operating  interval  (At)  and 
the  design  lifetime  (t^)  on  which  Fig.  2 is  based. 

Load  Intensity  Distribution 

The  intensity  of  the  internal  structural  loads  fluctuates  with 
time  (o  = O(t) ) as  the  structure  experiences  changes  in  the  applied 
loads.  Note  that  these  applied  loads  consist  of  both  the  external  and 
inertial  forces  and  moments  that  are  imposed  on  the  structure,  whereas 
the  internal  structural  loads  consist  of  the  forces  and  moments  acting 
between  adjoining  portions  of  the  structure. 

During  any  given  operating  interval,  an  element  in  the  structure 
may  experience  many  different  load  intensit>  levels.  Thus,  even  though 
the  applied  load  that  causes  the  element  to  fail  may  not  cause  the 
structure  to  fail,  a subsequent  load  may  still  cause  the  structure  to 
fail  before  the  conclusion  of  the  operating  interval.  To  account  for 
this  possibility,  the  approach  uses  the  maximum  load  intensity  for  the 
operating  interval  to  determine  whether  structural  failure  has  occurred 
during  that  interval.  To  simplify  the  calculations,  the  approach  also 
uses  this  same  maximum  load  intensity  to  determine  whether  element 
failure  has  occurred  during  the  operating  interval.  The  assumptions 
that  justify  this  later  simplification  are  introduced  in  this  section 
as  Assumptions  4 and  6 (see  pp.  15  and  16). 

Convention  for  Measuring  the  Load  Intensity.  Because  components 
with  different  cross-sectional  areas  will  carry  different  loads  even 
if  they  have  similar  locations  in  the  structure,  one  must  consider  the 
loads  carried  per  unit  of  cross-sectional  area.  This  load  per  unit 
area,  or  stress , increases  near  holes,  cutouts,  and  cracks.  Thus,  to 
calculate  the  local  stress  at  a specific  location,  the  stress  analyst 
often  uses  a two-step  procedure.  First,  he  takes  the  location  of 
interest  and  a description  of  the  applied  loads  and  calculates  a 
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Calculation  scale  ( t) 

Cumulative  operating  time  in  flight  hours 

Fig.  4 — Crack  propagation  history 

theoretical  stress  based  on  the  assumption  that  holes,  cutouts,  and 
cracks  do  not  exist  in  the  structure.  By  convention,  he  refers  to 
this  theoretical  stress  as  the  gross  area  stress  because  it  does  not 
account  for  holes,  cutouts,  and  cracks  that  reduce  the  cross-sectional 
area  available  for  transmitting  loads.  Because  the  structure  must 
transmit  the  loads  around  such  discontinuities,  the  actual  stresses 
at  such  discontinuities  usually  exceed  the  gross  area  stress.  Thus, 
in  the  second  step,  he  must  calculate  a correction  factor  (sometimes 
referred  to  as  a stress  concentration  factor)  to  account  for  this  local 
redistribution  of  the  load.  Even  if  the  stress  analyst  can  accomplish 
the  stress  calculation  in  a single  step,  he  often  uses  the  gross  area 
stress  as  the  conventional  measure  of  the  load  Intensity  that  occurs 


in  the  structure  as  a consequence  of  the  applied  loads.  This  report 
adopts  that  convention. 

Source  for  Load  Intensity  Data.  If  the  user  of  this  methodology 
does  not  have  a representative  distribution  of  maximum  load  intensity 
levels  (i.e.,  maximum  gross  area  stress  per  operating  interval),  he 
may  have  to  use  the  representative  distribution  of  peak-stresses  that 
the  fatigue  and  fracture  analyst  uses  to  estimate  the  rate  at  which 
cracks  enlarge.  For  aircraft  structures,  these  analysts  usually  de- 
fine the  peak-stress  event  as  the  maximum  gross  area  stress  that  occurs 
after  each  upward  crossing  of  a specified  reference  level.  For  trans- 
port aircraft,  they  often  base  the  reference  level  on  the  gross  area 
stress  that  occurs  during  level  unaccelerated  flight  (i.e.,  the  1 g 
gross  area  stress).  Because  aircraft  frequently  deviate  from  this 
condition,  each  operating  interval  (e.g.,  flight)  yields  a set  of 
different  peak-stress  values.  Only  the  maximum  value  for  a given 
operating  interval  represents  the  maximum  load  intensity  required  here. 
Appendix  D discusses  the  implications  of  using  such  a peak-stress 
distribution. 

Remaining  Strength  of  the  Cracked  Element 

Once  the  postulated  crack  reaches  a certain  length,  the  remaining 
strength  of  the  element  with  the  crack  decreases  as  the  crack  continues 
to  enlarge.  Information  to  represent  this  phenomenon  is  easily  ob- 
tained because  the  fatigue  and  fracture  analyst  must  have  it  to  make 
a safe-life  calculation.  The  information  may  come  from  laboratory 
experiments,  theoretical  calculations,  or  a combination  of  both  (Refs. 
3,  4,  and  5). 

For  a given  crack  size  and  identical  locations,  repeated  experi- 
ments with  different  test  specimens  show  relatively  little  scatter  in 
the  observed  remaining  strength  values.  A deterministic  (rather  than 
a probabilistic)  relationship  is  used  to  represent  this  phenomenon. 
Figure  3 presents  the  deterministic  relationship  used  in  the  example 
application.  The  surface  length  (a)  is  used  as  the  measure  of  crack 
size,  and  the  gross  area  stress  (a)  as  the  measure  of  load  intensity. 
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In  the  example,  the  element  Is  defined  to  be  two  panels  of  the 
eleven  overlapping  panels  that  form  the  lower  surface  of  the  inner 
wing  box.  Each  is  about  one  foot  wide  and  about  one-quarter  inch 
thick.  Each  has  two  integral  stiffners;  one  also  has  an  integral 
riser.  The  operator  has  assumed  that  both  panels  might  have  a fatigue 
crack  propagating  from  a common  fastener  location.  Furthermore,  once 
one  of  the  panels  fails,  the  other  presumably  fails.  Thus,  although 
Fig.  3 was  developed  for  only  a single  panel,  given  the  operator  speci- 
fied assumptions,  the  figure  can  also  be  used  for  the  element  of 
interest. 

Time  Required  for  Crack  Enlargement 

The  operating  time  required  for  the  postulated  crack  to  enlarge  by 
a specified  amount  depends  on  (1)  the  material's  crack  growth  charac- 
teristics, (2)  the  operating  environment,  and  (3)  the  time-varying 
intensity  of  the  stresses  that  occur  around  the  crack's  leading  edge. 
Although  the  development  of  the  crack  propagation  curve  presented  in 
Fig.  4 requires  a fair  amount  of  effort,^  most  airframe  manufacturers 
already  develop  such  curves  in  applying  the  safe-life  philosophy  (Ref. 
5).  The  computations  required  by  the  probabilistic  approach  should 
constitute  a relatively  small  additional  burden. 

Figure  4 presents  a curve  that  depicts  crack  size  as  a function 
of  flight  hours.  This  curve  was  used  to  establish  the  wing's  modifica- 
tion schedule.  Although  the  curve  starts  with  an  initial  crack  size 
having  a 0.05  inch  corner  radius,  the  probability  of  element  failure  is 
so  remote  for  cracks  having  a surface  length  less  than  0.8  inch  that 
the  probability  calculation  need  not  start  before  the  crack  is  that 
long.  To  demonstrate  this  point,  the  example  calculations  will  start 
with  an  initial  crack  size  having  a surface  length  of  0.7  inch.  Figure 
4 contains  a second  time  scale  with  an  origin  (t  = 0)  at  the  point  where 
the  example  calculations  start  (a  = 0.7  inch).  Of  course,  the  starting 
point  for  the  calculation  is  problem  dependent. 

It  is  interesting  to  observe  that  the  safe-life  limit  for  the 
current  wing  has  been  established  on  the  basis  of  the  8000  flying  hours 


See  Appendix  D for  a summary. 
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required  for  a 0.05  inch  radius  corner  crack  to  enlarge  to  a through- 
the-thickness  crack  having  a surface  length  of  0.8  inch. 

Remaining  Strength  of  the  Structure 

If  the  applied  load  that  causes  the  element  of  interest  to  fail 
also  causes  the  structure  to  fail,  then  that  applied  load  has  caused 
the  intensity  of  the  internal  structural  loads  to  exceed  the  remaining 
strength  of  the  structure  (a  ) . Because  more  than  one  applied  load 

T*  S 

condition  may  cause  the  internal  structural  loads  to  have  the  same 
load  intensity,  it  is  convenient  to  use  the  load  intensity  to  measure 
the  remaining  strength. 

Source  for  Remaining  Strength  Data.  During  the  design  of  many 
structures,  especially  airframes,  the  manufacturer  calculates  this 
information.  Sometimes  he  uses  a full-scale  remaining  (residual) 
strength  test  for  verification.  Because  repeated  tests  show  relatively 
little  scatter  in  the  results,  the  methodology  uses  a deterministic 
representation  for  this  input. 

Data  Used  in  the  Example  Application.  The  manufacturer  designed 
the  structural  members  of  interest  so  that  if  any  single  panel  failed 
the  rest  of  the  structure  would  not  fail  provided  that  (1)  the  panels 
adjoining  the  failed  panel  contained  no  significant  strength  degrading 
cracks  and  (2)  the  applied  loads  causing  panel  failure  did  not  cause 
the  load  intensity  to  exceed  42  Ksi. 

Subsequent  to  the  design  of  the  structure,  however,  the  concern 
has  arisen  that  during  manufacture,  an  inadvertent  action  may  have 
damaged  two  adjoining  panels  where  they  overlap  at  a common  fastener 
hole.  In  such  a case,  both  members  might  fail  simultaneously.  The 
estimated  residual  strength  (°rg)  following  the  postulated  dual  panel 
failure  is  30  Ksi,  provided  that  fatigue  cracks  have  not  significantly 
weakened  the  panels  that  are  still  intact.^ 

Treatment  of  the  Uncertainties  Implicit  in  the  Inputs 

The  accuracy  of  the  inputs  will  vary  depending  on  the  particular 
application.  Whenever  a significant  uncertainty  exists,  the  user 

^See  Appendix  D. 


should  make  appropriate  sensitivity  analyses  by  postulating  alternative 
inputs  and  repeating  the  calculations  according  to  the  procedure  de- 
scribed in  Sec.  III. 


UNDERLYING  ASSUMPTIONS 

To  keep  the  calculation  procedure  simple  and  straightforward,  a 
few  limitations  are  imposed  so  that  calculations  can  be  made  by  hand 
and  thus  the  basic  phenomena  influencing  the  results  can  be  better 
understood.  Each  user  can  add  whatever  methodological  embellishments 
he  finds  appropriate  for  his  particular  problem.  Moreover,  minimizing 
the  amount  of  information  required  also  minimizes  opportunities  for 
misinformation  to  undermine  the  credibility  of  the  calculated  results. 

Of  course,  to  take  results  from  a simple  model  and  make  meaningful 
extrapolations  to  real  world  situations  requires  a thoughtful  analysis 
of  the  simplifying  assumptions  underlying  the  model. 

The  first  two  assumptions  help  to  narrow  the  scope  of  the  necessary 
calculations : 

Assumption  1:  Detection  of  the  cracked  element  does  not  occur 
* before  the  crack  fails  the  element. 

Assumption  2:  Once  the  cracked  element  fails,  a completely  effec- 
tive repair /replacement  of  that  element  occurs 
before  the  structure  begins  the  next  operating 
interval . 

The  approximations  introduced  by  the  remaining  assumptions  justify 
certain  simplifications  that  significantly  reduce  the  complexity  of  the 
necessary  calculations. 

[ 

Assumption  3:  All  operating  intervals  have  the  same  duration. 

Assumption  4:  When  each  operating  interval  starts,  a single  step 
increase  in  the  crack  length  provides  an  adequate 
representation  for  the  total  crack  extension  that 
occurs  during  the  operating  interval. 


-16- 


Assumption  5. 


Assumption  6: 


The  operations  during  each  operating  interval  occur 
independently  of  the  operations  during  all  previous 
operating  intervals. 

If  the  load  intensity  exceeds  the  level  required  to 
fail  the  element  more  than  once  during  a given 
operating  interval,  the  highest  load  intensity 
level  occurs  first. 


Because  the  prospective  user  of  this  approach  must  formulate  his 
own  analysis  strategy  to  evaluate  the  implications  of  these  assumptions. 
Appendix  F provides  additional  discussion  of  their  implications. 
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III.  DERIVATION  OF  EQUATIONS 


THE  GENERAL  EQUATIONS 

For  a designated  element,  postulate  that  a crack  exists  at  a 
specified  location.  According  to  Assumption  1,  detection  of  the  cracked 
element  does  not  occur  before  the  crack  fails  the  element.  Let  a(t) 
represent  the  crack's  surface  length  as  a function  of  cumulative  oper- 
ating time  (t).  Define  the  origin  for  t such  that  a(0)  represents 
the  initial  crack  length  considered  by  this  approach  (e.g..  Fig.  4). 
Assumption  3 provides  that  each  operating  interval  has  a constant 
length  (say,  At).  After  i such  intervals,  the  crack  will  have  a sur- 
face length  aCt^),  where  t^  = i At.  Because  a(t)  varies  slowly  in  an 
operating  interval  (except  for  the  interval  where  element  failure 
occurs),  simplify  the  problem  by  assuming  that  the  crack  size  has  a 
constant  value  of  a(t^)  throughout  the  1th  interval  (Assumption  4). 

For  the  postulated  crack  site,  let  o(t)  represent  the  time-varying 
intensity  of  the  internal  structural  loads  that  the  applied  loads  would 

/v 

cause  in  an  idealized  structure  without  any  holes  or  cracks.  Let 
represent  the  maximum  value  of  a(t)  that  occurs  during  the  1th  operating 
interval.  If  ct^  5:  the  crack  will  instantaneously  fail  the  element. 

A 

If  0^  >.  the  structure  will  immediately  collapse.  Because  both  a ^ 

and  depend  on  the  crack's  size  (see  Figs.  1 and  3),  let  0^  = 0ef(a) 
and  ag£  = 0s^(a)  represent  these  relationships. 

The  postulated  crack  can  lead  to  an  element  failure  during  the  j th 
interval  only  if  it  has  not  failed  the  element  during  a prior  interval. 
Similarly,  because  Assumption  2 stipulates  that  the  structure  does  not 
start  an  operating  interval  with  a failed  element,  the  postulated  crack 
can  lead  to  a structural  failure  during  the  j th  interval  only  if  it  has 
not  led  to  the  element's  failure  during  a prior  interval.  Thus,  for 
x = e and  x = s, 


Pxf  ^j-l’V  1 Pnxf  (tj-l,tj) 


= Prob  jc^  < Oef(a(t1)) ; i-1,2 j-l j Prob  j a a^{ (a(t . 


)) 


(1) 


-18- 


denotes  the  probability  that  the  postulated  crack  leads  to  a type  x 
failure  during  the  j th  interval,  where  x = e for  an  element  failure 
and  x = s for  a structural  failure.  Justification  for  the  product 
contained  in  the  right-hand  side  of  Eq.  (1)  comes  from  the  fact  that 
Oj  must  not  depend  on  O.  (i=  1,  2,  j - 1)  because  Assumption  5 

stipulates  that  the  operating  conditions  during  the  j th  interval  occur 
independently  of  the  operating  conditions  during  prior  intervals;  note 
that  the  operating  conditions  govern  O(t)  and  hence  Oj . 

For  k consecutive  operating  intervals,  k different  outcomes  may 
occur  for  failure  type  x.  Thus 


k 

Pnxf(0,tk)  = 1 Pxf  (tj-l’V  * (X  = 6,S)  (2) 

3=1 

denotes  the  probability  that  during  the  time  (O.t^)  the  postulated 
crack  condition  will  not  lead  to  a type  x failure.  When  x = e,  and 

- a _ 

as  long  as  Prob  10^  S agj(a(tj))}  <<  1,  the  approximation 

k 

P„ef(0'tk)  -fl  f1  Pr°b{5i  * °e£(a<Cj))}]  (3) 

j=l 

provides  a useful  replacement  for  Eqs.  (1)  and  (2). 

For  convenience,  define 

rxf(ti)  = n(oxf (a(t1)))/td;  (x  = e,s)  , (4) 

where  n(ax^)  represents  the  expected  number  of  times  that  the  load 

intensity  would  exceed  o ^ during  one  design  lifetime  of  operation 

(e.g.,  see  Fig.  2).  The  design  lifetime  (t^)  must  have  the  same  units 

as  At.  For  the  j th  operating  interval,  r f(t.)  At  represents  the  ex- 

x t j 

pected  number  of  times  that  the  load  intensity  would  exceed  Ox^(a(tj)) 
during  one  operating  interval.  Because  all  operating  intervals  have 
the  same  fixed  duration  (Assumption  3),  these  intervals  must  be 
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uniformly  distributed  over  the  cumulative  operating  time.  Thus, 
given  Assumption  6,  the  uniform  distribution  and  independence  proper- 
ties that  stem  from  Assumptions  3 and  5 and  the  restriction  that 
rxf(t J At  « 1,  the  relation 

Pr°b{<jj  :>  °xf  (a(t.))  J = rxf(tj)  (5) 

provides  a reasonable  approximation  for  our  purposes. 

If  a.  £ aef(a(t.)),  the  element  of  interest  will  fail;  the  struc- 

ture  will  also  fail  if  a.  ^ O (see  the  dashed  line  in  Fig.  1).  De- 

J ts 

fine  t as  the  time  when  ae^(a(t))  = o (Fig.  1).  Prior  to  time  t, 

a ,(a(t.))  > a , and  thus  a c(a(t.))  = cr  r(a(t.)).  After  time  t, 
ef  j rs  sf  j ef  j 

O ,(a(t.))  < 0 , and  thus  a t(a(t.))  = a . Incorporate  these  re- 
ef j rs  sf  j rs  r 

suits  in  Eq.  (4)  and  recognize  that  n(°xj)  decreases  as  increases, 

whence 


r - (t.)  = min  I r , (t.) , n(o  )/t  1 . (6) 

sf  j l ef  j rs  d J 

Thus,  from  Eqs.  (3),  (4),  and  (5), 

k 

f«el(0-h>  -rlf1  ‘ ref(tJ)  At}  <7a) 

j = l 

and  from  Eqs.  (1),  (2),  and  (5), 

k 

■ 1 Vfl0'tj-l)rsf(t.i>  At  ' <7b) 

j=l 

Equations  (6)  and  (7)  present  the  general  result.  Appendix  G gives 
an  alternative  formulation  that  uses  integrals.  One  might  use  that 
form  along  with  simple  expressions  for  n(a),  a^Ca),  and  a(t)  to  ob- 
tain an  approximate  analytical  solution. 


-20- 


AN  APPROXIMATE  PROCEDUPE  FOR  HAND  CALCULATIONS 

The  values  for  r ^ and  rg^  vary  in  a sufficiently  slow  manner 

that  one  can  make  a useful  approximate  calculation  by  hand  if  he 

assumes  that  the  values  for  r , and  r , remain  constant  over  a sequence 

ef  sf 

of  consecutive  operating  intervals.  Let  such  a sequence  define  a cal- 
culation interval;  assign  a value  to  the  index  a to  represent  each 
calculation  interval  (a  = 1,  2,  3,  ...).  Assume  that  each  calculation 
interval  contains  an  even  number  of  operating  intervals;  let  2k^  repre- 
sent that  number.  Thus,  the  midpoints  for  successive  calculation 
intervals  (e.g.,  t ) are  given  by 


t 

a 


t , + 

a-1 


(k  . + 
a-1 


k ) At 
a 


(8) 


where  k^  = 0 and  t^  = 0. 

Let  the  last  operating  interval  that  occurs  prior  to  time  t 
have  an  index  L^.  From  Eq.  (8), 


a-1 


L = k + 
a a 


2k 


6 • 


8=0 


Assume  that  r , and  r c have  constant  values  equal  to  r ,(t  ) and 
_ ef  sf  ef  a 

rsf(ta)  durin8  < 
interval  a-1, 


rgj(ta)  during  calculation  interval  a.  Thus,  for  the  last  half  of 


L ,+k  , 

a-1  a-1 


||  I1  ref(tj)  At}  = I1  ref(ta-l)  At} 


(9a) 


j=L  ,+1 

J a-1 


and 


L ,+k  . 

a-1  a-1 


j=L  ,+1 

J a-1 


P f(0,t.) 

rsf(tj)  At 

ef  j 


= k 


a-1 


Pnef<°»ta-1) 

1 ‘ ref (^a-l)  At 


rsf (ta-l)  At 


(9b) 
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Lit 


Similarly,  for  the  first  half  of  Interval  a 


FI  I1  ' ref <tj>  At}  • i1  - re£(Ic>  4t}  “ ^ 


j=L  -k  +1 
a a 


x-n  P e(0,t.)  P £(0,t  ) 

T -r n— f , H . - r (t.)  At  = k — - r (t  ) At 

1 - ref(tj)  At  sf  j a 1 - r (I  ) At  sf  a 

j=L  -k  +1  61  J Tef(a)  UC 


Thus,  from  Eqs.  (7)  and  (9), 


P ,(0,t  ) = P _(0,t  ,)  f 1 - r ,(t  .)  At}  a 1 (l  - r _(t  ) At}  a , 

nef  a nef  a-l  { ef  a-l  / ( ef  a ) 

(10a) 


Pnpf(°,t  .) 

P ,(0,t  ) = P ,(0,t  ,)  - k . — r (t  ,)  At 

nsf  a nsf  a-l  a-l  , . sf  a-l 

1 * ref(ta-l)  At 


P *(0,t  ) 

, nef  a 

k r (t  ) At 

a , v » sf  a 

1 - ref(ta}  At 


(10b) 


A calculation  should  start  (i.e.,  t = 0)  with  a sufficiently 

small  crack  size  that  P r(-°°,0)  = 1.0,  and  P , (-°°,0)  = 1.0.  In 

nef  nsf 

such  a case,  one  can  prudently  commence  the  calculation  with  the  ini- 
tial conditions  P c(0,t,.)  = 1.0  and  P c(0,t„)  = 1.0.  With  such 
nef  * 0 nsf  0 

initial  conditions,  Eqs.  (4),  (6),  and  (10)  prescribe  all  of  the  cal- 
culations made  in  Sec.  IV. 
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IV.  EXAMPLE  CALCULATION 


This  example  illustrates  the  application  of  our  method  to  an 
element  that  forms  part  of  an  airframe's  exterior  surface.  The  oper- 
ator of  this  airframe  has  postulated  a crack  condition  that  he  has 
used  to  establish  limits  for  the  flying  hours  that  he  will  allow  this 
airframe  to  accumulate  before  the  manufacturer  incorporates  a major 
structural  modification  that  includes  replacing  the  element  of  interest. 

The  operator  has  assumed  that  the  postulated  crack  condition 
could  result  from  a faulty  manufacturing  operation  at  a fastener  hole 
located  along  a particular  joint  where  two  adjoining  panels  overlap. 

The  operator  has  reasoned  that,  because  the  holes  for  each  fastener 
were  drilled  through  both  panels  in  a single  manufacturing  operation, 
both  panels  could  have  sustained  damage  from  a faulty  drilling  or 
reaming  operation.  Moreover,  if  the  damage  was  sufficiently  severe, 
the  fastener  might  not  have  achieved  the  kind  of  interference  fit  that 
would  otherwise  prolong  fatigue  life  and  retard  crack  propagation. 
Furthermore,  if  the  panels  sustained  enough  damage,  the  fasteners 
may  not  have  firmly  clamped  the  panels  together.  Without  such  clamp- 
up,  friction  forces  might  not  develop  between  the  panels;  in  that  case, 
the  fasteners  (assumed  not  to  have  failed,  of  course)  would  have  to 
transfer  all  of  the  loads  between  the  panels.  Such  a fastener  load 
transfer  would  accelerate  the  early  phase  of  the  crack's  development. 

To  represent  the  effects  of  such  a rogue  condition,  the  operator 
specified  that  the  manufacturer  should  assume  that  during  fabrication, 
a crack  with  a 0.05  inch  surface  length  existed  at  the  postulated  loca- 
tion (see  the  Phase  I sketch  in  Fig.  4).  To  establish  the  maximum 
acceptable  size  to  which  the  operator  would  allow  this  hypothetical 
crack  to  grow,  he  specified  that  the  manufacturer  should  use  the  limit 
load  as  the  failing  load  condition.  The  limit  load  gross  area  stress 
of  42  Ksi  yielded  a maximum  acceptable  crack  length  of  about  0.8  inch. 
The  operator  had  reasoned  that  if  cracks  developed  from  a common 
fastener  located  in  two  adjoining  panels,  and  if  one  of  the  cracks 
readied  a length  of  about  0.8  inch,  then  a limit  load  condition  would 
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probably  fail  both  of  the  panels  as  well  as  cause  a catastrophic 
collapse  of  the  structure.  Moreover,  an  overlapping  panel  could  ob- 
scure a crack  less  than  1.6  inches.  It  might  also  obscure  signs  of 
fuel  leakage  that  might  otherwise  signify  the  presence  of  a crack. 

Using  the  representative  operational  use  from  a recent  year,  and 
the  configuration  of  the  aircraft  at  that  time,  the  manufacturer  cal- 
culated that  it  would  take  8000  flight  hours  for  the  0.05  inch  corner 
crack  to  enlarge  to  a 0.8  inch  surface  length  (see  Fig.  4).  The  oper- 
ator has  subsequently  stipulated  that  no  aircraft  will  accumulate  more 
than  8000  flight  hours  before  a major  modification  replaces  this  por- 
tion of  the  structure. 

THE  ISSUE 

If  the  operator  postpones  this  modification  and  uses  this  aircraft 
beyond  the  current  8000-hour  limit,  what  chances  does  he  take  that  a 
catastrophic  structural  failure  will  occur?  Consider  the  following 
situation:  (1)  Suppose  the  postulated  crack  condition  develops  in  the 

two  adjoining  panels.  (2)  Also,  suppose  that  detection  of  these  cracks 
does  not  occur  before  they  fail  both  panels.  What  is  the  probability 
that  such  a dual  panel  failure  will  not  lead  to  the  catastrophic  col- 
lapse of  the  structure? 

For  this  situation , the  subsequent  calculation  shows  that  there 
is  a 97.4  percent  chance  that  the  structure  will  not  collapse. 

THE  CALCULATION 

The  inputs  consist  of  Figs.  2 through  4,  an  estimated  residual 
strength  of  a^s  = 30  Ksi  for  the  postulated  dual  panel  failure  (see 
Appendix  D) , and  an  assumed  flight  duration  At  = 5 hours.  The  design 
lifetime  on  which  the  values  for  n are  based  (Fig.  2)  is  t^  = 30,000 
hours . 

To  record  the  input  information  in  Table  1,  use  the  following 
procedure  for  each  calculation  interval: 

1.  Select  the  number  of  flights  (2^)  for  the  current  calculation 
inte.  il  (a)  and  use  F.q.  (8)  to  calculate  the  midpoint  (t^) 


Preliminary  Calculations  Prn..,Wrv  nf  element  Failure  Probability  of  No  Structural 
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for  this  Interval;  record  the  values  for  a,  k , and  t In 

a a 

columns  1 through  3. 

2.  Use  t = t and  enter  the  lower  scale  In  Fig.  A to  obtain  the 

a 6 

crack  length  (a(t^));  record  this  value  in  column  A. 

3.  Take  this  crack  length  (a(t^))  and  enter  Fig.  3 to  obtain  the 
gross  area  stress  at  which  element  failure  would  occur  (0e^(a)); 
record  this  value  in  column  5. 

A.  Take  this  gross  area  stress  (°ef( a))  and  enter  Fig.  2 to  ob- 
tain the  number  of  times  that  the  load  intensity  would  exceed 
this  level  in  one  30,000  hour  lifetime  of  operation  (nCcr^)); 
record  this  value  in  column  6. 

To  make  the  necessary  preliminary  calculations 

1.  Use  Eq.  (A)  to  calculate  r -(t  ) At;  record  this  value  in 

M ef  a 

column  7. 

2.  Use  Eq.  (6)  to  calculate  rsf(ta)  At;  record  this  value  in 
co lumn  8 . 

To  complete  the  probability  calculations,  assume  that  P ^(O.tg)  = 
1.0000  and  P j(0,tQ)  = 1-0000  and  carry  out  the  calculations  pre- 
scribed by  Eqs.  (10a)  and  (10b).  Table  1 contains  the  pertinent  values 
in  columns  9 through  13.  The  values  in  columns  10  and  12  support  the 
assumed  initial  conditions  for  the  four  significant  figures  displayed; 
the  first  two  intervals  offer  no  contribution  to  the  results.  More- 
over, the  monotonic  behavior  of  the  inputs  assures  us  that  prior  inter- 
vals would  not  contribute  either. 

To  minimize  the  error  caused  by  the  assumption  that  r ^ remains 
constant  throughout  a given  calculation  interval,  the  size  of  the 

calculation  interval  decreases  as  r r increases. 

ef 

THE  RESULTS 

Columns  11  and  13  contain  the  desired  results.  Table  2 summarizes 
these  results  for  selected  times  and  corresponding  crack  lengths. 

Note  that  the  first  column  in  Table  2 presents  the  cumulative  flight 
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Table  2 

SUMMARY  OF  RESULTS 


Cumulative 
Flight 
Time  (hr) 


From  a From  the  Start 
0.05  Inch  of  the  Calcula- 
Crack  tion  (t) 


Probability  that  the  Dual 
Panel  Crack  Condition 
Does  Not  Lead  to — 


Crack 
Length 
in  Inches 
(a) 


Element 
Failure  by 
Time  t 

P„ef<0't> 


Structural 
Failure  by 
Time  t 

Pn.f(0’t) 


7900 

300 

0.8 

1.000 

1.000 

8500 

900 

1.2 

0.995 

0.995 

8800 

1200 

1.6 

0.98 

0.989 

9050 

1450 

2.0 

0.95 

0.985 

9600 

2000 

3.5 

0.50 

0.976 

9875 

2275 

4.9 

0.05 

0.974 

9925 

2325 

5.3 

0.01 

0.974 

time  measured  relative  to  the  time  when  the  postulated  crack  reaches 
a 0.05  inch  length.  When  a given  crack  would  reach  such  a length  de- 
pends on  the  conditions  that  cause  the  crack  to  start.  However, 
because  the  operator  of  this  aircraft  believes  that  such  a crack  might 
conceivably  start  in  a new  aircraft,  he  has  adopted  the  cumulative 
flight  hours  in  column  1 and  the  crack  length  in  column  3 to  establish 
the  maximum  number  of  hours  that  he  will  allow  this  aircraft  to  accumu- 
late. To  set  this  service  limit,  the  operator  in  effect  judged  that 
the  probability  of  the  crack's  leading  to  an  element  failure  would  in- 
crease rapidly  soon  after  the  crack  had  reached  a limit  load  critical 
length  of  about  0.8  inch.  Indeed,  the  results  for  P ^ show  a rapid 
decline  that  develops  about  a thousand  hours  after  the  crack  reaches 
a length  of  0.8  inch,  thus  confirming  this  aspect  of  the  operator's 
concern. 

The  operator,  however,  had  an  additional  concern  that  simultaneous 

failure  of  the  two  panels  would  probably  lead  to  immediate  failure  of 

the  structure.  The  results  for  P , in  Table  2 show  a 97.4  percent 

nsf  r 

chance  that  the  structure  would  not  fail  provided  that  the  previously 
stipulated  assumptions  hold  (see  Sec.  II).  For  example,  detection  of 
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the  crack  does  not  occur  before  the  element  fails,  and  detection  of  an 
element  failure  occurs  prior  to  the  next  flight.  Table  2 shows  a 98 
percent  chance  that  an  element  failure  should  not  occur  before  the 
postulated  crack  reaches  a length  of  1.6  inches.  Once  it  reaches  that 
length,  it  becomes  visible  from  outside  the  aircraft  and  detection  be- 
cause of  fuel  leakage  becomes  increasingly  more  probable.  Assuming 
detection  and  repair  at  that  point,  the  operator  suffers  at  most  a 1.1 
percent  chance  of  losing  the  aircraft  prior  to  that  time.  Note  that 
Table  2 shows  a 3.5  inch  expected  mean  value  for  the  crack  length  at 
the  time  element  failure  occurs. 

Even  if  the  postulated  crack  reaches  a 5 inch  (or  even  longer) 
length  without  being  detected,  the  structure  has  a 97.4  percent  chance 
of  not  failing.  Moreover,  Table  2 shows  that  most  of  the  2.6  percent 
chance  that  it  will  fail  occurs  while  the  crack  has  a length  between 
1.2  and  3.5  inches,  and  over  half  of  this  threat  occurs  after  the  crack 
has  exceeded  a length  of  1.6  inches.  Thus,  based  on  these  calculations, 
the  operator  no  longer  needs  to  assume  that  a crack  will  necessarily 
lead  to  a panel  failure  before  it  reaches  a length  of  1.6  inches. 
Furthermore,  even  if  a crack  does  progress  undetected  and  eventually 
leads  to  a dual  panel  failure,  there  is  only  a small  chance  that  the 
structure  will  fail. 

SENSITIVITY  OF  THE  RESULTS 

If  only  a single  panel  fails,  the  structure  has  a residual  strength 

of  a =42  Ksi  (rather  than  30  Ksi) . In  this  case,  the  structure  has 
rs 

a 99.9  percent  chance  of  not  failing  before  the  crack  reaches  a length 
of  1.6  inches  (see  Appendix  H) . Even  if  the  postulated  crack  is  assumed 
to  develop  without  being  detected,  the  structure  still  has  a 99.9  per- 
cent chance  of  not  failing  if  only  a single  panel  fails. 

Assumption  1 has  an  obvious  influence  on  this  example  (see  Sec.  II). 
Once  the  postulated  crack  reaches  a length  of  1.6  inches,  the  overlapping 
panel  can  no  longer  block  an  inspector's  view  of  the  crack.  Moreover, 
fuel  leakage  from  a wing  fuel  tank  becomes  increasingly  more  likely  as 
the  crack  enlarges  beyond  that  point.  Although  the  dual  panel  crack 
condition  might  be  detected  during  an  internal  inspection  of  the  wing 


structure,  the  detection  probability  increases  significantly  once  the 
crack  can  be  detected  by  external  inspection.  Recall  that  Table  1 
shows  that  over  half  of  the  2.6  percent  chance  that  the  structure  will 
fail  occurs  after  the  crack  has  reached  a length  of  1.6  inches.  Be- 
cause it  typically  takes  800  hours  for  the  crack  to  advance  from  1.6 
to  3.5  inches,  frequent  external  inspections  for  cracks  having  lengths 
in  that  range  could  help  to  reduce  the  chances  of  a catastrophic  struc- 
tural failure. 

Other  factors  that  may  influence  this  example  include  the  assump- 
tions underlying  the  curves  in  Figs.  2 and  4.  Those  curves  represent 
an  aircraft  configuration  and  operational  use  that  causes  higher 
stresses  than  the  current  operation  of  the  currently  configured  air- 
craft. Thus,  for  the  current  aircraft,  the  postulated  crack  would 
enlarge  at  a significantly  slower  rate  than  indicated  in  Fig.  4.  More- 
over, the  current  aircraft  will  less  frequently  exceed  the  gross  area 
stress  levels  at  which  element  failure  and  structural  failure  would 
occur.  One  might  expect  that  these  factors  should  reduce  the  chances 
of  a catastrophic  structural  failure.  However,  to  generate  a meaning- 
A ful  sensitivity  analysis,  the  manufacturer  would  probably  have  to 

. . first  provide  current  curves  for  both  Figs.  2 and  A.'*’ 

^See  Appendix  I for  additional  suggestions. 
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V.  OBSERVATIONS  AND  RECOMMENDATIONS 


For  the  rarely  occurring  postulated  crack  condition  examined  here, 
it  is  38  times  more  probable  that  a dual  panel  failure  will  occur  with- 
out structural  failure  than  with  structural  failure.  Thus,  subject  to 
the  stipulated  assumptions,  one  would  expect  the  postulated  crack  con- 
dition to  lead  to  38  dual  panel  failures  that  do  not  cause  a structural 
failure  for  every  such  dual  panel  failure  that  does  cause  a structural 
failure.  However,  if  the  postulated  crack  condition  only  extends  to  a 
single  panel,  then  one  would  expect  1000  single  panel  failures  that  do 
not  cause  a structural  failure  for  every  such  single  panel  failure  that 
does.  The  historical  experience  of  similarly  constructed  aircraft  as 
well  as  the  cracks  detected  in  the  fatigue  test  article  for  this  air- 
craft suggest  that  single  panel  failures  should  occur  much  more  fre- 
quently than  dual  panel  failures.  Therefore,  before  a catastrophic 
structural  failure  occurs,  one  can  expect  a large  number  of  single  or 
even  dual  panel  failures  to  occur  first. 

Moreover,  recall  that  the  example  used  a worst  case  element  loca- 
tion in  the  sense  that  the  location  had  the  shortest  crack  propagation 
time  and  therefore  governed  the  current  service  limit.  Other  wing 
panels  on  this  aircraft  experience  lower  stresses  and  thus  have  larger 
crack  propagation  times  and  higher  probabilities  that  the  same  kind 
of  crack  will  not  lead  to  a structural  failure.  Thus,  if  the  postu- 
lated crack  condition  existed  at  a random  location,  rather  than  a worst 
location,  one  would  expect  numbers  much  larger  than  the  38  and  1000. 

This  damage  tolerance  exhibited  by  the  aircraft  examined  in  the 
example  does  not  necessarily  extend  to  all  aircraft  structures.  For 
example,  whereas  the  aircraft  in  the  example  has  eleven  independent 
panels  comprising  the  primary  load-carrying  structure  of  the  wing's 
lower  surface,  some  aircraft  have  only  a single  panel  supported  by 
perhaps  a dozen  stiffeners  and  in  some  cases  the  stiffeners  can  only 
carry  a small  fraction  of  the  lower  surface  loads.  Consequently,  for 
such  a structure  a single  panel  failure  necessarily  causes  structural 
failure.  Other  aircraft  have  three  or  four  panels  joined  by  internal 


splicing  stiffeners  and  spar  caps  that  have  a significant  load-carrying 
capability.  If  the  failure  of  an  internal  component  goes  undetected, 
the  crack  development  and  enlargement  processes  in  the  adjoining  panel 
will  accelerate,  and  a dual  component  failure  becomes  a matter  of 
serious  concern.  Because  aircraft  structures  are  not  usually  designed 
to  tolerate  a dual  component  failure,  many  of  them  will  fail  if  two 
adjoining  components  fail. 

The  aircraft  considered  in  the  example,  therefore,  has  two  sig- 
nificant virtues.  First,  because  it  has  no  internal  (hidden)  primary 
load-carrying  components  (except  for  doublers)  that  comprise  the  wing's 
lower  surface,  a single  component  failure  is  not  likely  to  go  undetected 
and  thus  should  not  contribute  to  a dual  component  failure  mode. 

Second,  even  if  two  adjoining  components  in  the  critical  area  fail, 
the  structure  will  not  fail  with  probability  0.974.  Thus,  even  a dual 
component  failure  will  probably  not  cause  a structural  failure.  Some 
aircraft,  however,  have  components  susceptible  to  the  dual  component 
failure  mode,  and  they  have  a low  chance  of  surviving  such  a failure. 
This  wide  range  of  damage  tolerance  capabilities  exists  because  the 
kind  of  probabilities  calculated  here  have  not  been  calculated  as  an 
integral  part  of  the  structural  design  process.  We  recommend,  there- 
fore, that  operators  require  manufacturers  to  use  a probabilistic 
approach,  such  as  the  one  presented  here,  to  help  evaluate  the  need 
for  major  structural  modification  programs.  This  would  assure  that 
the  modification  fits  into  a broader  strategy  to  manage  the  threat 
posed  by  seldom  occurring  fatigue  cracks  that  can  appear  in  any  air- 
craft the  operator  uses. 

The  approach  proposed  here  provides  a capability  to  help  assess 
the  risk  incurred  when  a crack  develops  sooner  than  expected,  or  when 
aircraft  arrive  at  a service  limit  in  an  undamaged  state  and  continue 
in  operation  beyond  that  limit.  Currently,  some  approaches  to  estab- 
lishing service  limits  attempt  to  assess  when  a crack  with  a limit  load 
critical  crack  length  might  develop  in  the  structure.  To  establish 
a reasonably  safe  limit,  some  operators  require  the  manufacturer  to 
incorporate  conservative  assumptions  in  the  calculation  process.  None- 
theless, this  cannot  preclude  the  possihility  that  a crack  might  reach 
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a limit  load  critical  length  sooner  than  expected.  Furthermore,  as  a 
consequence  of  the  necessarily  conservative  assumptions  incorporated 
in  the  assessment  process,  an  aircraft  might  arrive  at  the  specified 
service  limit  without  exhibiting  any  significant  evidence  of  service- 
limiting  fatigue  cracks  in  the  structure.  In  such  an  event,  the  oper- 
ator might  decide  to  use  the  aircraft  beyond  the  original  limit. 

The  calculation  of  a safe  service  limit  based  on  an  assumed  ini- 
tial flaw  size  provides  a reasonable  and  useful  procedure  for  control- 
ling the  design  stress  levels  and  materials  used  in  future  aircraft. 

It  also  provides  a preliminary  estimate  for  a service  limit.  Our  prob- 
abilistic approach  provides  a procedure  for  assessing  the  structure's 
ability  to  tolerate  element  failures  resulting  from  undetected  fatigue 
crack  propagation.  Thus,  we  recommend  that  operators  and  manufacturers 
augment  their  service  limit  assessment  procedures  with  a probabilistic 
approach  such  as  the  one  presented  here  to  provide  a superior  approach 
for  managing  the  risk  presented  by  unexpected  and  undetected  fatigue 
cracks . 

Application  of  this  approach  during  the  design  phase  could  help 
to  assure  uniform  damage  tolerance  capabilities  for  new  structures. 
Structural  maintenance  personnel  could  use  the  same  kind  of  informa- 
tion to  accomplish  a more  cost-effective  allocation  of  resources  used 
to  maintain  and  improve  the  damage  tolerance  of  operational  structures. 
People  who  either  operate,  or  certify  the  operation  of,  structures 
could  use  this  damage  tolerance  information  to  assess  the  relative 
risk  of  operating  different  structures  after  it  is  first  suspected 
that  an  isolated  element  may  contain  a service-induced  fatigue  crack. 
Thus,  we  recommend  that  manufacturers  adopt  a probabilistic  approach 
such  as  the  one  presented  here  to  help  inform  management  about  a 
structure's  damage  tolerance  capability  throughout  the  structure’s 
life  cycle — from  early  design  through  final  retirement. 
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Appendix  A 

CATASTROPHIC  FAILURE  OF  AIRCRAFT  .STRUCTURES 

Fatigue  cracks  that  cause  airframe  structures  to  fail  usually 
start  where  the  geometry  of  an  element  causes  a local  concentration 
of  stresses.  A further  concentration  of  stresses  sometimes  occurs  as 
a result  of  a faulty  manufacturing  or  maintenance  operation.  The 
greatest  stress  concentration  frequently  occurs  at  faulty  fastener 
holes,  because  even  for  a properly  prepared  hole  under  elastic  condi- 
tions the  maximum  stress  can  equal  three  times  the  stress  at  a loca- 
tion one  or  two  hole  diameters  away.  Thus,  a fastener  hole  with  a 
manufacturing  or  maintenance  irregularity  constitutes  a prime  source 
for  a fatigue  crack,  especially  if  the  hole  occurs  in  a highly  stressed 
element . 

Although  fatigue  cracks  can  eventually  develop  in  fastener  holes 
that  do  not  have  any  manufacturing  irregularities,  this  report  focuses 
mainly  on  the  early  cracks  that  can  develop  at  fastener  holes  having 
irregularities.  Examples  of  the  relevant  irregularities  include  burrs, 
radial  tears,  rifle  marks,  gouges,  and  improperly  installed  fasteners. 
The  method  presented  in  this  report  can  assess  the  probability  that  a 
structural  failure  would  eventually  occur  if  an  unexpected  fatigue  crack 
should  enlarge  without  being  detected. 

Regardless  of  the  source,  during  a crack's  early  development  phase 
its  size  increases  slowly  and  because  of  its  small  size,  it  does  not 
noticeably  decrease  the  overall  strength  of  the  structure.  In  many 
cases,  however,  fatigue  cracks  eventually  reach  a size  where  they  can 
appreciably  influence  stength.  Sometimes  catastrophic  structural 
failure  results. 

RECENT  EXAMPLES 

Boeing  707  Near  Lukasa,  Zambia 


On  May  14,  1977,  the  right  side  of  the  horizontal  tail  of  an  all- 
cargo configured  707-321  collapsed  following  an  in-flight  element 
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failure  that  occurred  while  approaching  the  runway  at  Lukasa.  The  air- 
craft, operated  by  Dan  Air,  had  accumulated  47,000  flight  hours. 
Following  the  collapse,  it  entered  a steep  dive  and  crashed.  None  of 
the  five  occupants  survived  (Refs.  6,  7,  and  8). 

Lockheed  C-141A  Near  Mildenhall,  England 

On  August  28,  1976,  severe  atmospheric  turbulence  apparently 
caused  the  catastrophic  structural  failure  of  a C-141A  wing.  Manu- 
factured by  Lockheed  and  operated  by  the  USAF  Military  Airlift  Command, 
the  aircraft  had  accumulated  15,372  flight  hours.  The  wing  failure 
occurred  at  about  10,000  feet  as  the  aircraft  approached  Mildenhall 
Air  Force  Base.  None  of  the  18  occupants  survived  (Ref.  9).  Investi- 
gators examined  pieces  of  the  failed  wing  that  had  not  been  consumed 
by  fire  but  could  find  no  evidence  of  fatigue  cracks  that  would  have 
weakened  the  wing.  The  failure  may  have  occurred  when  turbulence 
imposed  an  aerodynamic  load  on  the  wing  that  would  have  even  exceeded 
the  strength  capability  of  a new  wing. 

This  example  illustrates  that  aircraft  structures  do,  on  occasion, 
experience  an  extraordinarily  high  applied  load. 

Lockheed  L-382  Near  Springfield,  Illinois 

On  May  23,  1974,  an  all-cargo  configured  version  of  the  USAF/ 
Lockheed  C-130  operated  by  Saturn  Airways  had  the  outboard  section  of 
the  left  wing  collapse  after  an  element  failure.  The  resulting  im- 
balance in  the  aerodynamic  loads  caused  the  aircraft  to  enter  a violent 
roll  and  yaw  that  overloaded  the  outboard  section  of  the  right  wing, 
thus  causing  it  to  collapse  also.  The  aircraft  then  descended  at  a 
steep  angle  from  21,000  feet  and  crashed;  none  of  the  four  occupants 
survived.  The  aircraft,  which  had  had  its  fuselage  lengthened  by  80 
inches  in  1972,  had  accumulated  18,837  flight  hours  (Refs.  10  and  11). 

POTENTIAL  ROLES  FOR  THE  CALCULATION  PROCEDURE 

The  calculation  procedure  proposed  by  this  report  might  help  to 
avert  some  failures  like  those  just  discussed.  For  example,  the 
failure  of  an  obscured  or  partially  visible  spar  cap  apparently  led 
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to  both  the  707  and  the  L-382  failures  (Refs.  6,  7,  8,  10,  and  11). 

To  apply  this  probabilistic  procedure  to  an  obscured  component,  one 
would  have  to  accept  the  obscured  component's  failure  as  a given  and 
postulate  the  existence  of  the  fatigue  crack  in  an  adjoining  unobscured 
component  such  as  the  surface  panel  that  obscures  the  spar  cap.  By 
calculating  the  probability  that  such  a dual  component  failure  would 
not  lead  to  a structural  failure,  one  could  assess  the  structure's 
vulnerability  to  such  a failure  mode.  This  could  help  indicate  the 
relative  importance  of  establishing  special  inspection  and  modifica- 
tion actions  for  the  most  critical  areas  of  the  structure. 

Hindsight  now  tends  to  suggest  that  the  spar  cap  areas  where  the 
cited  failures  occurred  are  indeed  critical;  moreover,  these  areas 
may  not  have  received  as  much  attention  as  they  deserved  (Refs.  6,  10, 
and  11).  It  would  be  interesting  to  find  out  whether  this  calculation 
procedure  could  have  helped  to  provide  some  degree  of  foresight. 

Because  the  C-141A  and  KC-135  also  have  obscured  spar  caps,  it 
might  be  interesting  to  apply  this  procedure  to  those  aircraft  as  well. 
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Appendix  B 

THE  PROBABILISTIC  APPROACH  AND  SHORTCOMINGS 
OF  CURRENT  APPROACHES 


Both  the  fail-safe  and  the  safe-life  philosophies  have  desirable 
design  features.  The  fail-safe  forces  the  designer  to  use  multiple 
independent  elements  to  transmit  loads  through  a structure;  the  safe- 
life  forces  him  to  use  materials  and  design  stress  levels  that  should 
preclude  the  possibility  that  the  specified  initial  crack  might  reach 
the  critical  length  during  the  aircraft's  specified  operating  life. 

The  shortcomings  of  both  philosophies,  however,  have  stimulated 
debate. 

THE  FAIL-SAFE  PHILOSOPHY 

The  success  of  the  fail-safe  philosophy  hinges  on  the  assumption 
that  no  cracks  exist  in  the  structure  adjoining  a failed  element.  Of 

course,  the  validity  of  such  an  assumption  cannot  be  assured  in  all 
situations.  For  example,  consider  the  L-382  incident  described  in 
Appendix  A.  Two  elements  adjacent  to  the  first  element  that  failed 
contained  cracks  in  the  immediate  neighborhood  of  the  initial  failure 
site.  Because  of  these  cracks,  the  elements  could  not  stop  the  pro- 
gression of  the  failure. 1 

The  National  Transportation  Safety  Board  (NTSB)  report  does  not 
say  whether  these  cracks  developed  before  or  after  the  initial  element 
failure  (Ref.  11).  If  the  initial  element  failure  occurred  first,  then 
the  failure  to  promptly  discover  that  condition  (e.g.,  within  a cer- 
tain number  of  flights)  provided  the  time  for  the  additional  loads 
(that  the  failed  element  had  transferred  to  the  adjoining  elements) 
to  cause  the  accelerated  development  of  the  fatigue  cracks  found  in 
those  elements. 

If  the  cracks  developed  before  initial  element  failure  occurred, 
however,  the  accumulated  operational  use  of  that  portion  of  the 

^See  Appendix  A for  how  the  proposed  procedure  might  have  been 
applied  to  this  situation. 
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structure  had  exceeded  the  amount  of  use  necessary  to  cause  the  indi- 
cated general  state  of  cracking.  In  either  case,  proponents  of  the 
safe-life  philosophy  can  claim  that  the  accident  might  not  have  oi  curred 
if  the  manufacturer  and  the  operator  had  limited  aircraft  operation 
to  a calculated  safe-life  interval,  because  the  initial  element  failure 
should  not  have  occurred  during  such  an  interval. 

Furthermore,  the  safe-life  advocates  can  argue  that  the  fail-safe 
philosophy  has  another  Achilles'  heel  in  the  applied  load  used  to  de- 
sign the  structure  to  meet  the  fail-safe  criterion.  If  an  applied  load 
exceeds  this  fail-safe  design  load,  and  if  that  load  fails  the  element 
of  interest,  then  a structural  failure  will  occur.  No  matter  how  high 
a design  load  one  selects,  an  applied  load  might  exceed  it. 

THE  SAFE-LIFE  PHILOSOPHY 

The  success  of  the  safe-life  philosophy  hinges  on  the  assumption 
that  the  specified  length  of  the  initial  crack  adequately  accounts  for 
all  design/manufacturing/maintenance  errors  that  might  occur.  Moreover, 
for  any  initial  crack  condition  that  the  safe-life  advocates  postulate, 
the  fail-safe  advocates  can  postulate  the  occurrence  of  a more  severe 
condition.  To  soften  that  argument,  the  safe-life  advocates  can  postu- 
late an  extremely  severe,  and  rarely  occurring,  initial  crack  condition 
(sometimes  referred  to  as  a rogue  flaw) . Nonetheless,  no  matter  how 
severe  a rogue  flaw  assumption  one  makes,  someone  else  can  conjure  up 
an  even  more  disastrous  situation  that  might  occur.  For  example,  in 
addition  to  the  assumed  crack  length,  the  rogue  flaw  condition  often 
presumes  a very  extreme  situation,  for  example:  (1)  least  inspectable 
crack  location;  (2)  highest  crack  growth  rate  location;  (3)  highest 
crack  growth  rate  environment;  (4)  no  crack  growth  retardation  benefit 
from  interference  fit  fasteners;  and  (3)  no  load  transfer  benefits  from 
the  friction  between  overlapping  structural  components.  Nonetheless, 
even  worse  conditions  might  occur,  albeit  with  ever -decreasing  proba- 
bilities of  occurrence;  for  example,  the  strength  of  the  material  may 
fall  below  specifications. 

To  provide  reasonable  assurance  that  cracks  will  not  develop  to  a 
size  where  they  would  threaten  the  structural  integrity  of  new  designs. 
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the  U.S.  Air  Force  has  established  design  requirements  based  on  the 
rogue  flaw  concept  and  a safe-life  calculation  (Ref.  1),  together  with 
considerations  about  fail  safety.  The  Air  Force  has  also  used  this 
approach  to  estimate  how  long  it  can  safely  use  existing  airframes 
before  modification  or  replacement  of  components  (Ref.  2).  The  United 
Kingdom's  Airworthiness  Requirements  Board  (ARB)  has  also  considered 
using  the  approach  to  help  establish  mandatory  retirement  dates  for 
older  aircraft  (Refs.  12  and  13).  The  UK  ARB  concern  stems  from  inci- 
dents where  the  wings  came  off  an  F-27  and  an  HS-748;  both  aircraft 
were  thought  to  have  "fail-safe"  designs.  Moreover,  the  pressure 
cabin  failures  of  a Herald  and  a Vanguard,  as  well  as  the  707  incident 
in  Zambia, ^ have  increased  the  ARB's  concern. 

The  current  Air  Force  approach  requires  a fixed  extreme  value 
specification  for  two  probabilistic  phenomena:  (1)  the  occurrence  of 
a rogue  flaw  and  (2)  the  occurrence  of  the  applied  load  that  causes 
failure.  The  latter  may  come  from  an  unusually  severe  maneuver  or 
extreme  atmospheric  turbulence,  or  a combination  of  both.  Thus,  the 
success  of  this  kind  of  extreme  value  approach  depends  on  whether  the 
postulated  applied  load  represents  a sufficiently  extreme  and  rarely 
occurring  condition  (sometimes  referred  to  as  the  rogue  load  condition). 
But  no  matter  how  severe  the  set  of  rogue  flaw  and  rogue  load  assump- 
tions one  makes,  an  even  more  serious  pair  of  situations  might  occur 
that  the  safe-life  approach  does  not  cover.  Although  an  approach  that 
explicitly  deals  with  the  likelihood  of  such  situations  occurring  '.ay 
appear  superior  to  an  extreme  value  approach,  the  validity  of  such  an 
approach  depends  on  the  validity  of  the  inputs. 

A PROBABILISTIC  APPROACH 

Because  dependable  probabilistic  information  seldom  if  ever  exists 
for  the  likelihood  of  a rogue  flaw  occurrence,  the  probabilistic  ap- 
proach proposed  here  circumvents  the  rogue  flaw  issue  and  uses  a prob- 
abilistic representation  only  for  the  applied  load. 


See  Appendix  A for  how  the  proposed  procedure  might  have  been 
applied  to  this  situation. 


The  safe-life  value  calculated  by  an  extreme  value  approach  de- 
pends strongly  on  the  extent  of  the  postulated  rogue  flaw  condition. 

And,  unfortunately,  the  limited  data  from  crack  distributions  observed 
in  service  aircraft  frequently  cannot  support  attempts  to  assess  the 
likelihood  that  a particular  rogue  flaw  condition  will  occur  in  a 
specific  element  of  a given  structure.  Thus,  to  postulate  an  initial 
equivalent  crack  length  to  represent  a rogue  flaw  condition,  one  must 
rely  on  experienced  judgment  rather  than  on  a reasonable  knowledge  of 
the  applicable  manufacturing  quality.  That  approach,  therefore,  ac- 
cepts some  unknown  risk  of  early  life  structural  failures  because  the 
rogue  flaws  actually  present  in  the  structure  might  exceed  the  severity 
assumed  for  the  safe-life  calculations.  Since  earlier  methods  of 
fatigue  analysis  largely  ignored  the  existence  of  rogue  flaw  occur- 
rences, the  extreme  value  approach  represents  a significant  improve- 
ment. However,  the  probabilistic  approach  presented  here  provides 
a simple  calculation  procedure  to  assess  the  probable  consequences 
of  undetected  rogue  flaws  no  matter  what  their  initial  size . 

The  safe-life  value  calculated  by  the  extreme  value  approach  also 
depends  on  the  accuracy  of  the  growth  rate  computation  for  small  cracks. 
One  problem  with  accurately  modeling  the  growth  rate  for  small  cracks 
involves  the  computation  of  the  stress  intensity  at  the  tip  of  a corner 
crack  located  at  a fastener  hole  (a  common  location  for  cracks  to  ini- 
tiate). Whereas  test  results  support  the  calculations  for  large  cracks, 
it  is  much  more  difficult  to  obtain  reliable  test  data  for  small  corner 
cracks.  Because  the  crack  spends  most  of  its  life  while  it  is  small 
and  slowly  enlarging  rather  than  when  it  is  large  and  rapidly  enlarging 
(because  of  the  acceleration  of  the  cracking  process  with  crack  length) , 
errors  in  the  consideration  of  the  stress  intensity  for  small  cracks 
can  have  a significant  effect  on  the  calculated  crack  growth  time. 

Thus,  the  calculation  of  the  growth  times  for  very  small  corner  cracks 
must  be  considered  to  be  much  less  precise  than  the  calculations  for 
cracks  that  are  several  times  the  thickness  of  the  member.  The  proba- 
balistic  approach  only  requires  crack  qrowth  rate  information  for  the 
larger  crack  sizes  at  which  element  failures  usually  occur. 
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A further  difficulty  with  an  extreme  value  approach  arises  from 
the  way  the  rogue  load  assumption  interacts  with  judgments  about  the 
inspectability  of  the  element  postulated  to  contain  the  rogue  flaw. 
Currently,  the  Air  Force  uses  the  limit  load  condition  for  the  rogue 
load  condition  for  all  types  of  aircraft.  The  limit  load  is  the  maxi- 
mum load  that  a given  element  would  ever  have  to  transmit  provided 
that  (1)  the  pilot  always  keeps  the  aircraft  within  the  operating  lim- 
itations specified  by  the  manufacturer  and  (2)  the  neighboring  ele- 
ments continue  to  transfer  their  own  loads.  Because  conditions  can 
arise  where  an  element  may  have  to  transmit  a load  larger  than  the 
limit  load,  an  element  in  an  aircraft  structure  is  usually  designed  to 
carry  at  least  150  percent  of  the  limit  load  (assuming  that  the  ele- 
ment has  no  cracks  in  itj 

Although  atmospheric  turbulence  can  cause  an  aircraft  to  exceed 
a limit  load  condition,  this  very  rarely  occurs  for  a transport  air- 
craft. Thus,  if  a transport  continued  to  operate  beyond  the  calculated 
safe-life  number,  the  crack  from  the  postulated  rogue  flaw  condition 
would  probably  continue  to  grow  before  actual  failure  occurred.  This 
might  provide  a significant  opportunity  to  discover  the  crack  before 
element  failure  occurred.  Moreover,  as  the  crack  grows , it  becomes 
increasingly  more  probable  that  the  element  failure  will  occur  due  to 
the  application  of  a smaller  load  than  limit  load.  The  probabilistic 
approach  provides  a procedure  that  explicitly  accounts  for  this  factor. 
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Appendix  C 

THE  POTENTIAL  ROLE  FOR  THE  PROBABILISTIC  APPROACH 


Throughout  the  life  of  an  airframe  structure,  the  manufacturer, 
operator,  and  any  cognizant  regulatory  agency  should  continuously  ex- 
amine actions  that  might  reduce  the  chances  of  a catastrophic  structural 
failure.  Although  the  kind  of  information  generated  by  the  probabil- 
istic approach  should  interest  each  of  these  parties,  the  manufacturer 
would  probably  have  to  perform  the  actual  calculations  and  analysis 
throughout  the  airframe's  life  cycle. 

The  motivation  for  developing  the  approach  stems  from  the  premises 
that  a more  efficient  allocation  of  available  resources  during  each 
aircraft's  life  cycle  could  reduce  the  probability  of  catastrophic  struc- 
tural failure.  A joint  application  of  both  the  fail-safe  and  the  safe- 
life  philosophies  may  do  a better  job  of  reducing  the  chances  of  a 
catastrophic  structural  failure  than  the  application  of  only  one  phil- 
osophy. Thus  the  approach  described  here  combines  aspects  of  each 
philosophy  in  a procedure  that  either  circumvents  or  deals  with  the 
major  shortcomings  of  each  philosophy.  Although  some  design  features 
of  existing  aircraft  already  reflect  an  ad  hoc  melding  of  philosophies, 
the  approach  proposed  here  formally  combines  elements  of  each  philosophy. 
With  this  approach,  one  can  rigorously  assess  the  relative  degrees  of 
fail-safety  associated  with  different  elements  forming  an  aircraft 
structure . 

DESIGN  PHASE 

During  this  phase,  the  probabilistic  approach  could  serve  as  (1) 
a design  tool  for  helping  to  identify  the  most  failure-critical  ele- 
ments by  ranking  elements  according  to  the  calculated  probability  that 
an  undetected  fatigue  crack  would  lead  to  a structural  failure;  (2)  a 
basis  for  revising  design  and  manufacturing  quality  standards;  and 
(3)  a basis  for  providing  the  prospective  operator  a better  opportunity 
to  receive  meaningful  feedback  on  those  design  compromises  that  influence 
the  possibility  of  a structural  failure. 
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Although  the  manufacturer's  legal  liability  provides  a long-term 
incentive  for  him  to  minimize  the  possibility  of  a catastrophic  struc- 
tural failure,  short-term  incentives  during  the  design  phase  can  tend 
to  work  against  fulfillment  of  that  long-term  responsibility.  For 
example,  a designer  may  have  to  add  material  to  the  structure  to  de- 
crease stresses  or  to  employ  small  multiple  elements  in  place  of  a 
large  single  element.  Such  actions  increase  both  weight  and  manufac- 
turing costs  while  reducing  the  performance  potential  (e.g.,  payload), 
which  can  jeopardize  the  survival  of  a new  aircraft  design  program, 
especially  if  the  prospective  operator  does  not  understand  the  trade- 
off between  the  cost/performance  factors  and  the  possibility  of  cata- 
strophic structural  failure.  The  probabilistic  approach  generates 
information  for  the  prospective  operator  to  help  him  procure  equipment 
that  more  efficiently  minimizes  the  possibilities  of  catastrophic 
structural  failures  for  a given  set  of  life-cycle  resources . 

OPERATING  PHASE 

During  this  phase,  this  probabilistic  approach  could  serve  as 
(1)  a tool  for  identifying  failure-critical  elements  based  on  actual 
patterns  of  operational  use;  (2)  a basis  for  establishing  a maintenance 
and  inspection  standard  or  specification;  and  (3)  a basis  for  providing 
the  operator  a better  opportunity  to  understand  the  potential  conse- 
quences of  alternative  combinations  of  operating  plans,  inspection 
programs,  and  structural  rework/modification  programs. 

Because  the  actual  patterns  of  operational  use  frequently  deviate — 
sometimes  significantly — from  the  assumed  patterns  used  by  the  manu- 
facturer when  he  designs  the  structure,  the  operator  should  consider 
requesting  a reassessment  of  the  failure-critical  elements  once  he  has 
established  an  actual  pattern  of  operational  use. 

For  the  operator  who  has  different  aircraft  types  in  his  fleet, 
the  probabilistic  approach  may  provide  information  to  help  him  stan- 
dardize his  inspection/rework/modification  p'~iicies  on  a consistent 
basis.  He  can  then  allocate  resources  to  minimize  the  chances  that  a 
catastrophic  structural  failure  will  occur  to  any  of  his  different  types 
of  aircraft. 
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Although  the  shared  legal  liability  of  the  operator  and  the  manu- 
facturer provides  a continuing  incentive  for  them  to  minimize  the 
chances  of  a catastrophic  structural  failure,  the  operator  and  the 
manufacturer  have  divergent  economic  incentives  during  the  operating 
phase.  Rework  and/or  modification  programs  provide  profit  opportun- 
ities to  the  manufacturer  and  expense  items  to  the  operator.  Some 
operators,  therefore,  try  to  closely  examine  the  programs  proposed  by 
the  manufacturer.  However,  a thorough  examination  of  the  details  that 
underlie  the  rationale  for  the  manufacturer's  proposal  can  require  an 
effort  that  few  operators  have  the  resources  and  will  to  undertake. 

In  such  cases,  the  operator  can  either  accept  the  manufacturer's  pro- 
posal, perhaps  following  a pro  forma  review,  or  he  can  negotiate  a 
compromise  program  without  fully  appreciating  the  consequences  of  the 
compromises. 

The  disadvantageous  position  of  the  operator  stems  largely  from 
limitations  on  the  information  available  to  him.  For  example,  the 
operator  may  have; 

o The  manufacturer's  assessment  of  the  time  when  fatigue  cracks 
may  develop. 

o A record  of  cracks  detected  in  his  fleet. 

o A sometimes  ill-defined  perception  of  the  aircraft's  fail- 
safe capability. 

If  the  operator  has  no  other  information,  he  may  not  even  negotiate 
the  extent  of  the  program  proposed  by  the  manufacturer.  If  of  economic 
necessity  he  has  to  negotiate  a more  affordable  program,  he  may  not 
understand  the  possible  consequences.  The  probabilistic  approach  can 
provide  that  understanding  and  thus  a better  assessment  of  the 
inspection/rework/modification  programs  proposed  by  the  manufacturer. 

Because  the  operator  has  a finite  set  of  resources  available  for 
airframe  maintenance,  he  cannot  eliminate  the  possibility  of  a cata- 
strophic structural  failure.  How  effectively  he  reduces  the  proba- 
bility of  such  an  outcome  depends  on  both  the  total  resources  available 


and  the  efficiency  with  which  he  applies  those  resources.  Thus , a 
primary  objective  of  this  report  is  to  propose  an  approach  that  can 
improve  the  quality  and  relevance  of  the  information  available  to  the 
operator. 
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Appendix  D 

DEVELOPMENT  OF  INPUT  INFORMATION 

The  input  information  used  in  the  example  came  from  the  aircraft's 
manufacturer.  This  appendix  provides  further  details  on  the  prepara- 
tion of  that  information. 

LOAD  INTENSITY  DISTRIBUTION 

To  assemble  this  information,  the  manufacturer  records  and/or  pre- 
dicts the  applied  loads  that  the  aircraft  may  experience  during  various 
operational  uses.  Using  the  frequency  with  which  the  aircraft  experi- 
ences these  uses,  the  manufacturer  can  project  the  expected  distribution 
of  applied  loads  that  will  occur  over  the  aircraft's  design  lifetime  and 
construct  a corresponding  distribution  for  the  intensity  of  internal 
structural  loads  that  occur  at  a specified  location  in  the  structure. 
With  this  kind  of  procedure,  the  manufacturer  can  construct  an  expected 
distribution  for  the  maximum  load  intensity  that  occurs  during  each 
flight.  He  can  also  construct  the  expected  peak-stress  distribution 

I 

that  the  fatigue  and  fracture  analysts  use. 

Use  of  a peak-stress  distribution,  rather  than  a maximum  load 
intensity  distribution,  may  create  some  problems.  Because  development 
of  the  preferred  distribution  and  development  of  the  peak-stress  dis- 
tribution could  occur  simultaneously,  and  probably  for  a relatively 
small  marginal  cost,  manufacturers  should  seriously  consider  develop- 
ment of  the  preferred  distribution  for  the  approach  proposed  here. 
Meanwhile,  the  peak-stress  distribution  used  by  the  fatigue  and  frac- 
ture analyst  can  suffice  for  exploratory  or  illustrative  applications. 

A peak-stress  distribution  tends  to  cause  an  underestimate  for 
the  probability  that  the  element  will  not  fail,  which  tends  to  cause 
an  overestimate  in  the  probability  that  the  structure  will  not  fail. 

For  example,  examine  the  calculations  for  column  12  in  Table  1 (see 
Sec.  IV).  Too  low  a value  for  column  11  causes  too  high  a value  for 
column  12;  however,  the  same  factor  that  causes  the  underestimate  for 
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column  11  causes  an  overestimate  for  column  8.  This  causes  an  under- 
estimate for  the  probability  that  the  structure  will  not  fail  (see 
column  12).  Thus,  to  an  extent  these  errors  offset  each  other. 

Both  errors  stem  from  an  overestimate  of  n(a  that  worsens  as 

xf 

the  value  of  a , decreases.  For  large  values  of  0 the  peak-stress 
xf  xf 

distribution  should  not  introduce  very  much  error.  However,  as  0 ^ 
decreases,  the  user  should  become  increasingly  more  alert  to  the 
possibility  of  a problem. 

In  many  situations,  the  indicated  tendencies  to  overestimate  or 
underestimate  the  failure  probabilities  will  not  seriously  degrade 
the  utility  of  the  results.  For  example,  if  the  user  has  made  a con- 
sistent analysis  of  the  comparative  failure  probabilities  associated 
with  the  many  different  elements  of  a given  structure,  the  relative 
ordering  of  the  results  should  mostly  remain  valid,  even  though  the 
absolute  magnitude  of  individual  results  may  deviate  from  the  real 
probability.  To  make  a consistent  analysis,  the  same  kind  of  distribu- 
tion (i.e.,  the  peak-stress  distribution)  should  be  used  for  each  ele- 
ment. Two  factors  govern  this  distribution:  location  in  the  structure 
and  a sequence  of  operating  conditions.  However,  the  second  factor 
is  the  same  for  all  elements  in  the  same  structure.  Thus,  when  the 
second  factor  includes  extraneous  events  (i.e.,  events  not  included 
in  the  maximum  load  intensity  distribution),  it  does  so  for  each  ele- 
ment's peak-stress  distribution;  any  tendency  to  overestimate  the 
failure  probabilities  must  apply  to  the  estimate  for  every  element. 
Thus,  the  relative  differences  in  the  failure  probabilities  will  arise 
from  differences  in  element  location,  element  geometry,  and  element 
materials . 

TIME  REQUIRED  FOR  CRACK  ENLARGEMENT 

The  operating  time  required  for  the  postulated  crack  to  enlarge 
by  a specified  amount  depends  on  the  material's  crack  growth  character- 
istics, the  operating  environment,  and  the  time-varying  intensity  of 
the  stresses  that  occur  around  the  crack's  leading  edge.  The  instan- 
taneous value  of  the  stress  intensity  (K)  depends  on  (1)  the  crack 
length;  (2)  the  load  Intensity  (e.g.,  the  gross  area  stress);  and 
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(3)  a geometry  dependent  factor  (g)  that  relates  the  load  intensity  (a) 
to  the  stress  intensity  (K)  for  a given  crack  length  (a).  In  general, 
to  first  approximation. 


K = g/ira  o . (D.l) 

To  determine  the  value  of  g,  which  often  varies  slowly  with  a,  frac- 
ture mechanics  analysts  use  stress  analysis  methods  based  on  the  linear 
theory  of  elasticity.  Thus,  as  long  as  significant  inelastic  behavior 
does  not  occur,  a rational  scientific  method  exists  for  calculating  the 
stress  intensity. 

Model  of  the  Crack  Enlargement  Mechanism 

For  a single  load  cycle,  laboratory  experiments  have  shown  that 
a relationship  like 


Aa  = C(AK)"1  , 


(D.2) 


where  to  first  approximation 


can  predict  the  amount  of  crack  enlargement  (Aa)  caused  by  one  load 

cycle  that  has  a minimum  load  intensity,  o ' , and  a maximum  load 

intensity,  o (see  Refs.  14-17).  The  empirical  coefficients  C and 
max 

m reflect  the  material's  crack  growth  characteristics.  Researchers 

have  found  that  the  load  ratio,  a , /a  , and  extreme  values  for  the 

min  max 

stress  intensity  range  (AK)  can  influence  these  coefficients.  How- 
ever, for  the  aluminum  alloys  used  in  aircraft  structures,  and  for 
the  stress  intensity  ranges  that  such  structures  usually  experience, 
the  value  of  m usually  remains  in  the  range  3 < m < 4 (Ref . 16) . In 
such  cases,  the  amount  of  crack  enlargement  Aa  approximately  increases 
as  the  crack  length  is  raised  to  a power  between  3/2  and  2.  Thus,  as 
the  crack  enlarges,  the  Incremental  amount  of  enlargement  caused  by  one 
load  cycle  increases. 
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Mod  el  of  the  Load  Fluctuations  that  Cause  Crack  Enlargement 

The  relevant  portion  of  the  structure  will  experience  a variety 

of  load  intensity  cycles  having  different  values  for  0 and  0 . 

max  min 

Thus,  to  construct  a representative  sequence  of  cycles,  the  fracture 
mechanics  analyst  must  first  develop  a model  to  represent  the  expected 
pattern  of  operational  use.  For  an  aircraft  structure,  he  might  use 
a block  of  100  flights  that  includes  a representative  mix  of  different 
missions . 

For  each  type  of  mission,  he  divides  the  flight  into  segments 
(e.g.,  taxi,  takeoff,  climb,  cruise,  etc.).  For  each  segment,  he  uses 
expected  values  for  the  aircraft's  operating  parameters  (e.g.,  weight, 
speed,  altitude,  flap  configuration,  engine  thrust  level,  etc.)  to 
calculate  the  expected  applied  loads  and  the  expected  intensity  of 
the  internal  structural  loads.  He  then  calculates  how  this  load  in- 
tensity would  change  in  response  to  aircraft  maneuvers  and  atmospheric 
turbulence.  To  model  the  frequency  and  the  extent  of  the  expected 
maneuvers  and  atmospheric  turbulence,  the  analyst  often  uses  data 
obtained  from  analyses  of  load  history  recordings  taken  during  flight. 
From  such  a model  he  constructs  a sequence  of  load  intensity  cycles 
to  represent  the  time-varying  load  intensity.  After  he  repeats  this 
exercise  for  each  mission  segment,  he  constructs  a sequence  of  load 
intensity  cycles  that  models  the  expected  load  Intensity  environment 
for  a single  mission.  After  completing  the  preceding  exercise  for 
each  mission  type,  he  constructs  a sequence  of  load  intensity  cycles 
that  models  the  expected  load  intensity  environment  for  the  100  flights 
contained  in  his  analysis  block. 

Model  of  the  Crack  Enlargement  Process 

For  any  initial  crack  size,  the  fracture  mechanics  analyst  can 
use  the  100-flight  sequence  of  load  intensity  cycles  to  determine  how 
much  crack  enlargement  should  occur  because  of  100  representative 
f lights . 

For  example,  where  the  stresses  near  the  leading  edge  of  the  crack 
do  not  exceed  the  elastic  limit,  the  analyst  can  take  the  initial  crack 
length  and  the  first  load  intensity  cycle  and  compute  the  incremental 
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amount  of  crack  enlargement  caused  by  that  cycle.  He  then  continues 
this  process  for  the  remaining  cycles.  Alternatively,  he  can  some- 
times use  the  100-flight  sequence  of  load  intensity  cycles  to  experi- 
mentally determine  the  expected  amount  of  crack  enlargement.  The 
viability  of  this  option  depends  on  the  complexity  of  both  the  local 
geometry  and  the  internal  structural  loads. 

In  either  case,  by  reapplying  the  sequence,  he  can  continue  the 
process  and  determine  the  cumulative  crack  enlargement  for  200  flights, 
300  flights,  ...,  etc.  He  can  use  this  information  to  plot  the  crack 
size  versus  the  number  of  flights  (or  flight  hours,  as  depicted  in 
Fig.  4). 

If  significant  plastic  deformations  occur  (i.e.,  the  elastic 
limit  is  exceeded)  near  the  leading  edge  of  the  crack,  the  calcula- 
tion method  becomes  somewhat  more  complicated.  But  the  approach  still 
parallels  the  preceding  illustration  (Ref.  17). 

Note  that  the  probability  calculations  in  Table  1 (Sec.  IV)  start 
at  a rather  large  initial  crack  length  (0.7  inch).  Because  the  calcula- 
tion does  not  depend  on  the  preceding  crack  propagation  history,  this 
probabilistic  approach  not  only  avoids  the  arbitrary  assumption  of  an 
initial  crack  length,  but  it  also  avoids  the  problems  peculiar  to 
estimating  the  rate  of  crack  enlargement  for  small  corner  cracks.  Two 
kinds  of  problems  arise.  (1)  It  is  difficult  to  accurately  model  the 
crack  propagation  behavior  of  a corner  crack  because  it  involves  a 
three-dimensional  geometry  whereas  the  through-the-thickness  crack 
only  poses  a two-dimensional  geometry.  (2)  Many  fastener  systems  that 
prolong  fatigue  life  (crack  initiation  times)  also  retard  crack  en- 
largement rates  for  small  cracks  because  of  local  inelastic  behavior 
near  the  fastener  hole.  Such  retardation,  which  Fig.  4 does  not  account 
for,  only  influences  the  crack  propagation  rate  for  the  first  few  tenths 
of  an  inch.  Thus,  the  probabilistic  approach  only  uses  the  more  re- 
liable portion  of  the  crack  propagation  curve. 

Nonetheless,  the  use  of  a crack  propagation  curve,  such  as  that 
in  Fig.  4,  involves  certain  implicit  assumptions,  such  as: 

o Arrest  of  the  crack  propagation  process  does  not  occur . 


f 
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o The  operational  use  of  the  structure  approximates  the  assumed 
pattern  used  to  develop  the  crack,  propagation  curve, 
o The  environment  in  which  operational  use  occurs,  especially 
humidity  and  salinity,  approximates  the  environment  of  the 
laboratory  tests  used  to  determine  the  material's  crack  growth 
characteristics. 


REMAINING  STRENGTH  OF  THE  CRACKED  ELEMENT 


The  element  will  fail  when  K = K^,  where  is  a property  of  the 
material  (called  the  fracture  toughness  or  the  critical  stress  in- 
tensity). Thus,  set  K = Kc  and  0 = 0 ^ in  Eq.  (D.l)  to  obtain 


K 

c 

&/rra 


(D  .4) 


For  the  example  application,  8 varies  slowly  with  the  crack  length. 

REMAINING  STRENGTH  OF  THE  STRUCTURE 

The  manufacturer  can  calculate  the  structure's  remaining  strength 
for  the  dual  member  failure  case  using  methods  similar  to  those  used 
for  the  single  member  failure  case.  Although  information  for  the  dual 
member  failure  case  is  not  available,  the  single  member  result,  cited 
previously,  can  be  used  to  estimate  the  dual  member  result.  For  ex- 
ample, to  estimate  the  remaining  strength  for  a double  member  failure, 
assume  that  (1)  the  second  member  has  the  same  width  (W)  as  the  wider 
of  the  two  members  and  (2)  the  members  have  comparable  cross-sectional 
areas. 

For  a linear  elastic  material,  the  stress  intensity  around  the 
crack's  leading  edge  increases  approximately  as  the  square  root  of 
the  crack  length  (Eq.  (D.l)).  Although  the  elastic  characteristics 
of  the  joint  where  the  members  overlap  will  differ  from  the  character- 
istics for  the  portion  of  the  element  between  that  joint  and  the  ad- 
jacent joints,  make  the  following  assumptions: 


o The  two  panels  of  interest,  together  with  their  adjoining 
joints,  have  uniform  elastic  characteristics. 
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o The  stress  intensity  required  for  a panel  failure  to  extend 
into  an  adjoining  panel  remains  constant  regardless  of 
whether  one  or  two  members  have  already  failed. 

For  the  same  stress  intensity  to  occur  after  either  a single  or 
dual  member  failure. 


6aSpF/^w  = BoDPF/f2w  , (D.5) 

where  0 D is  the  minimum  load  intensity  when  single  panel  failure 

orb 

occurs  and  a D is  the  minimum  load  intensity  when  a dual  panel 
^ * * 

failure  occurs.  Let  (and  o„_)  be  the  load  intensity  level (s) 

SPF  DPF 

that  must  be  exceeded  to  fail  the  panel  adjoining  the  single  panel 
failure  site  (double  panel  failure  site) . Thus  from  the  foregoing 
assumptions  and  Eq.  (D.5), 


aDPF  = aSPF^  • ^D'6^ 

For  the  example  considered  in  this  report,  0 = 42  Ksi.  Thus,  for 

SP  F 

the  example  considered  here,  if  the  applied  load  that  causes  dual  member 
failure  has  a load  intensity  (gross  area  stress)  that  exceeds  approxi- 
amtely  30  Ksi,  this  calculation  suggests  that  the  structure  should  fail. 
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Appendix  E 

HOW  INPUTS  INFLUENCE  RESULTS 


LOAD  INTENSITY  DISTRIBUTION 

Figure  2 shows  the  expected  number  of  times  that  the  load  intensity 
will  exceed  any  given  gross  area  stress  level  in  one  design  lifetime 
of  30,000  flying  hours.  For  example,  the  figure  shows  that  the  load 
intensity  is  expected  to  exceed  the  42  Ksi  gross  area  stress  caused  by 
a limit  load  condition  once  every  59  design  lifetimes  (1/0.017  = 59), 
whereas  it  is  expected  to  exceed  67  percent  of  the  limit  load  gross 
area  stress  (28  Ksi)  once  every  design  lifetime.  Thus,  as  the  gross 
area  stress  increases  from  67  to  100  percent,  the  probability  in  Table 
E.l  decreases  by  a factor  of  59.  Because  a modest  change  in  the  gross 
area  stress  can  cause  a substantial  change  in  that  probability,  the 
maximum  load  intensity  distribution  has  a significant  influence  on  the 
results  calculated  by  this  methodology . 

Table  E.l 

INFLUENCE  OF  LOAD  INTENSITY  DISTRIBUTION 
ON  THE  EXAMPLE  CALCULATION 


Load  Intensity  Probability  that  During  a Single 

as  a Percent  of  5-Hour  Flight  the  Load  Intensity 
the  Limit  Load  Will  Exceed  the  Level 

Gross  Area  Stress  in  Column  1 


67 


5 

1 x 30,000 


.00017 


100 


5 

59  x 30,000 


.0000028 


SOURCE:  Fig.  2. 


REMAINING  STRENGTH  OF  THE  CRACKED  ELEMENT 

Figure  3 shows  that  once  the  crack  has  broken  through  the  ligament 
between  the  fastener  hole  and  free  edge  of  the  element  (a  = 0.655  inch). 
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the  remaining  strength  begins  to  decrease  with  increasing  crack  length. 
The  fracture  mechanics  analysis,  from  which  this  figure  came,  assumed 
that  once  the  crack  broke  through  the  ligament,  the  crack  continued  to 
develop  from  a corner  on  the  opposite  side  of  the  fastener  hole.  This 
corner  crack  had  an  assumed  shape  of  a quarter  circle.  Once  it  reached 
a radius  that  equaled  the  thickness  of  the  element  (0.25  inch),  the 
analysis  assumed  that  the  crack  became  a through-the-thickness  crack; 
at  that  point,  a = 0.905  inch  (see  Fig.  4,  also). 

Observe  from  Fig.  3 that  once  the  crack  has  reached  a surface 
length  of  about  0.8  inch,  the  limit  load  condition  (42  Ksi)  will  cause 
the  element  to  fail.  Similarly,  once  the  crack  has  reached  a surface 
length  of  about  1.3  inches,  element  failure  will  occur  at  a load  condi- 
tion that  causes  a gross  area  stress  of  67  percent  of  the  limit  load 
gross  area  stress  (28  Ksi).  Thus,  for  this  example,  a half-inch  en- 
largement in  crack  length  (0.8  to  1.3  inches)  has  reduced  the  remain- 
ing strength  from  100  to  67  percent  of  the  limit  load  gross  area  stress. 
Adding  this  information  to  Table  E.l  shows  that  (see  Table  E.2)  if  the 
element  has  not  failed  during  a prior  flight,  the  probability  that  ele- 
ment failure  will  occur  during  the  next  5-hour  flight  increases  by  a 
factor  of  59  because  of  this  half-inch  enlargement  in  crack  length. 

TIME  REQUIRED  FOR  CRACK  ENLARGEMENT 

Figure  4 shows  that  it  would  take  about  700  flying  hours  for  a 
0.8  inch  crack  to  enlarge  to  1.3  inches.  Adding  this  information  to 
Table  E.2  and  rearranging  the  columns  shows  (see  Table  E.3)  that  if 
the  element  has  not  failed  during  a prior  flight,  the  probability  that 
the  element  failure  will  occur  during  the  next  5-hour  flight  increases 
by  a factor  of  59  because  of  the  half-inch  enlargement  in  crack  length 
that  occurs  over  the  period  of  700  flight  hours. 

Because  the  probability  increases  so  rapidly,  the  calculation 
procedure  must  use  a calculation  step  size  much  smaller  than  700  flight 
hours.  Moreover,  the  procedure  must  also  compute  the  cumulative  proba- 
bility that  the  element  has  failed  from  t = 0 (the  beginning  of  the 
calculation)  to  some  later  time  of  interest.  Section  III  provides  the 
details  for  that  calculation. 
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Table  E . 2 

INFLUENCE  OF  CRACK  LENGTH  ON  THE  EXAMPLE  CALCULATION 


Load  Intensity 
as  a Percent  of 
the  Limit  Load 
Gross  Area  Stress 


Crack  Length  at  Which 
the  Load  Intensity  in 
Column  1 will  Fail 
the  Element 


Probability  that  During  a 
Single  5-Hour  Flight  the  Load 
Intensity  Will  Exceed  the 
Level  in  Column  1 


100 


0.8 


5 

59  x 30,000 


.0000028 


67 


1.3 


5 

1 x 30,000 


.00017 


SOURCE: 


Fig.  3 


Fig.  2 


Table  E.3 

INFLUENCE  OF  ELEMENT'S  REMAINING  STRENGTH 
ON  THE  EXAMPLE  CALCULATION 


Time  in  Flight 
Hrs  (use  lower 
scale  in 

Fig.  4) 

Crack  Size 
(surface 
length  in 
inches) 

If  the  Load  Intensity 
Exceeds  This  level, 
the  Element  Fails 
(percent  of  the 
limit  load  gross 
area  stress) 

Probability  that 
During  a Single  5- 
Hour  Flight,  the 

Load  Intensity  Will 
Exceed  the  Level  in 
Column  3 

300 

0.8 

100 

59  * 30,000  ‘ •°000028 

1000 

1.3 

67 

1 * 30,000  ’ -00017 

SOURCE: 


Fig.  4 


Fig.  3 


Fig.  2 


-55- 


REMAINING  STRENGTH  OF  THE  STRUCTURE 

Figure  2 shows  that,  once  every  1.7  design  lifetimes,  the  peak 
stress  exceeds  30  Ksi.  Adding  this  information  to  Table  E.3  shows 
(see  Table  E.4)  that  (1)  if  the  postulated  crack  reaches  an  0.8  inch 
length  without  causing  the  element  to  fail,  then  during  the  next 
flight  the  probability  of  element  failure  equals  the  probability  that 
element  failure  will  cause  structural  failure;  and  (2)  if  the  postu- 
lated crack  reaches  a 1.3  inch  length  without  causing  the  element  to 
fail,  then  during  the  next  flight,  the  probability  of  element  failure 
equals  1.7  times  the  probability  that  element  failure  will  cause 

Table  E.4 

INFLUENCE  OF  STRUCTURE'S  REMAINING  STRENGTH 
ON  THE  EXAMPLE  CALCULATION 


If  the  Load  Intensity 
(Percent  of  the  limit 
Load  Gross  Area  Stress) 
Exceeds  This  Level 


Probability  that  During 
a Single  5-Hr  Flight 
the  Load  Intensity  Will 
Exceed  the  Level 
at  which 


Time  In  Flight 
Hours  (use 
lower  scale 
in  Fig.  4) 

Crack  Size 
(surface 
length  in 
inches) 

The  Dual 
Panel  Ele- 
ment Fails 

The  Struc- 
ture Fails 

The  Element 
Fails 

The  Struc- 
ture Fails 

300 

0.8 

100 

100 

. 00000283 

. 00000283 

1000 

1.3 

67 

71 

. 0001 7b 

.00010c 

SOURCE: 

Fig.  4 

Fig.  3 

_d 

Fig.  2 

Fig.  2 

a 


5 

59  x 30,000 


.0000028. 


b 


5 

1 x 30,000 


.00017. 


1.7  x 30,000 


.00010. 


d 


See 


preceding  discussion. 
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structural  failure.  Note  that  this  element  failure  probability  exceeds 
the  structural  failure  probability  for  all  crack  lengths  greater  than 
the  transition  Length  (see  Fig.  1).  Also  note  that  the  element  failure 
probability  equals  the  indicated  structural  failure  probability  for 
all  crack  lengths  smaller  than  the  transition  length. 

Figure  1 illustrates  why  this  transition  behavior  occurs.  For 
cracks  smaller  than  the  transition  length , the  load  intensity  at  which 
element  failure  occurs  always  exceeds  the  level  at  which  structural 
failure  attends  any  element  failure;  compare  the  short-dash  curve  to 
the  long-dash  curve  in  Fig.  1.  For  cracks  larger  than  this  transition 
length,  the  load  intensity  at  which  structural  failure  occurs  always 
exceeds  the  level  at  which  element  failure  occurs.  Thus,  beyond  this 
transition  crack  length,  the  element  may  fail  without  failure  of  the 
structure. 

THE  CALCULATION  PROCEDURE 

Each  row  in  Table  E.4  illustrates  a basic  calculation  procedure 
that  recurs  during  a corresponding  phase  of  the  calculation.  During 
the  first  phase,  the  crack's  length  has  not  reached  the  transition 
length;  see  the  first  row  in  Table  E.4.  During  the  second  phase,  the 
crack’s  length  has  surpassed  the  transition  length;  see  the  second  row 
in  Table  E.4.  During  either  phase,  the  probabilities  depicted  in  Table 
E.4  will  vary  rapidly  with  the  crack  length,  which  in  turn  varies  with 
time.  Moreover,  to  calculate  the  cumulative  probabilities  over  time, 
one  must  first  develop  the  probabilities  in  Table  E.4  as  a function  of 
time  (or,  in  other  words,  crack  length).  Thus,  the  basic  calculations 
illustrated  in  Table  E.4  must  recur  for  successive  increments  of  time. 
Section  III  presents  the  complete  procedure  for  calculating  the  cumu- 
lative probabilities. 


Appendix  F 


THE  ASSUMPTIONS  AND  SOME  IMPLICATIONS 


Assumption  1:  Detection  of  the  cracked  element  does  not  occur 
before  the  crack  fails  the  element. 

In  some  situations,  the  probability  of  element  failure  will  re- 
main quite  small  as  the  crack  continues  to  enlarge  past  the  size  at 
which  crack  detection  begins  to  be  a more  probable  event  than  element 
failure.  For  example,  consider  a through-the-thickness  crack  that 
has  enlarged  to  a size  that  measures  several  inches  along  the  surface 
of  an  element.  If  the  element  forms  part  of  the  wing's  lower  surface, 
it  may  also  form  the  lower  surface  for  an  integral  fuel  tank.  In  the 
past,  fuel  leakage  has  frequently  indicated  the  presence  of  a crack; 
either  the  flight  crew  has  recognized  the  loss  of  fuel  while  in  flight 
or  the  maintenance  crew  has  recognized  stains  on  the  wing.  Thus,  to 
properly  analyze  the  results  obtained  from  applying  this  approach  to 
a specific  element,  one  should  carefully  evaluate  the  implications  of 
Assumption  1.  To  facilitate  such  an  ex  post  facto  evaluation,  the 
calculation  procedure  provides  the  probability  that  the  element  will 
not  fail  as  a function  of  crack  length. 

Assumption  2:  Once  the  cracked  element  fails,  a completely 

effective  repair  or  replacement  of  that  element 
occurs  before  the  structure  begins  the  next 
operating  interval. 

If  the  failed  element  forms  part  of  the  structure  that  the  flight 
crew  cannot  readily  observe  during  a pre-flight  walkaround  inspection 
(e.g.,  the  upper  surface  of  the  horizontal  tail),  that  inspection  can- 
not be  relied  on  to  satisfy  Assumption  2.  However,  if  the  maintenance 
crew  performs  an  inspection  of  that  area  prior  to  every  flight,  then 
that  action  might  plausibly  satisfy  the  assumption.  Although  an  analy- 
sis should  consider  the  possibility  that  the  crew  might  not  detect  the 
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element  failure,  the  current  approach  separates  such  considerations 
from  the  basic  calculation. 

Of  course,  if  the  maintenance  crew  cannot  observe  the  candidate 
element  because  another  element  blocks  it  from  view,  then  external 
inspection  will  not  satisfy  Assumption  2.  For  example,  both  the  707 
and  L-382  accidents  described  in  Appendix  A involved  the  failure  of  a 
spar  aap.  A aap  in  a wing  or  tail  structure  connects  the  external 
skin  to  the  internal  webs  that  connect  the  upper  and  lower  surfaces; 
a spar  aap  is  a cap  that  runs  along  the  span  of  the  wing  (or  tail)  . 

In  some  aircraft  structures,  maintenance  crews  cannot  visually  inspect 
the  spar  cap  without  opening  up  the  structure  because  the  external 
skin  of  the  structure  completely  obscures  the  spar  cap  from  view.  In 
other  aircraft,  immediate  detection  of  a failed  spar  cap  may  not  occur 
if  it  only  has  a small  externally  visible  width.  Thus,  in  any  appli- 
cation of  this  methodology,  one  must  carefully  examine  the  postflight 
observability  of  the  postulated  element  failure. 

In  many  cases,  however,  maintenance  crews  and  flight  crews  can 
observe  many  of  the  fatigue  prone  elements.  For  example,  the  USAF 
KC-135  tanker  force  has  survived  thirty  incidents  where  a skin  panel 
on  the  wing’s  lower  surface  has  either  failed  in  flight  or  has  developed 
a crack  with  a surface  length  of  several  inches  (Ref.  18).  The  C-130 
and  the  C-141A  forces  have  also  survived  such  incidents  on  several  oc- 

1 

casions.  If  an  element  cannot  satisfy  Assumption  2,  that  fact  alone 
raises  serious  questions  about  the  degree  of  fail-safety  associated 
with  that  element. 


Aeaumption  3:  All  operating  intervals  have  the  same  duration. 

For  the  aircraft  considered  in  the  example,  most  flights  have  a 
duration  of  from  4 to  6 hours;  thus,  the  report  uses  an  assumed  oper- 
ating interval  of  5 hours.  Deviations  from  that  assumed  average  should 
not  significantly  influence  the  calculated  result  as  long  as  each  oper- 
ating interval  has  the  same  order  of  magnitude  and  the  duration  of  the 
largest  interval  remains  small  in  comparison  with  the  duration  of  the 
calculation  time  frame. 


1 
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As sumption  4:  When  each  operating  interval  starts,  a single  step 
increase  in  the  crack  length  provides  an  adequate 
representation  for  the  total  crack  extent  ion  that 
occurs  during  the  operating  interval. 

As  long  as  the  length  of  the  operating  interval  remains  small  in 
comparison  to  the  time  required  for  the  probability  of  no  element 
failure  to  decline  (e.g.,  see  column  10  in  Table  1),  this  assumption 
should  not  cause  any  significant  difficulties. 

Assumption  5:  The  operations  during  each  operating  interval  occur 
independently  of  the  operations  during  all  previous 
operating  intervals. 

This  assumption  should  remain  valid  as  long  as  the  mission  for 
each  operating  interval  is  assigned  independently  of  the  previous  mis- 
sions. Thus,  for  example,  this  assumption  should  not  pose  a problem 
as  long  as  each  aircraft  experiences  a representative  mixture  of 
missions . 

Assumption  6:  If  the  load  intensity  exceeds  the  level  required  to 
fail  the  element  more  than  once  during  a given  oper- 
ating interval,  the  highest  load  intensity  level 
occurs  first. 

If  Assumption  6 does  not  hold  and  if  the  element  failure  induces 
a dynamic  response  from  the  structure  that  causes  a significant  ampli- 
fication of  load  intensity,  then  in  certain  situations  a favorable 
order  of  occurrence  can  reduce  the  chances  that  a structural  failure 
would  occur.  For  example,  consider  two  separate  events  with  applied 
load  levels  (L^  and  l^)  that  exceed  the  level  required  to  fail  the 
element.  Assume  that  event  1 (L^)  does  not  fail  the  structure  and 
event  2 (I^)  fails  the  structure  only  if  it  also  fails  the  element. 

Thus,  in  this  situation,  if  the  element  fails  prior  to  the  occurrence 
of  event  2,  then  the  dynamic  response  of  the  structure  to  that  failure 
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cannot  amplify  the  internal  structural  loads  caused  by  • Without 
such  dynamic  amplification,  cannot  exceed  the  structural  failure 
level.  Therefore,  if  event  1 occurs  before  event  2 occurs,  event  2 
cannot  fail  the  structure.  However,  if  event  2 occurs  before  event  1 
would  have  occurred,  then  the  structure  does  fail.  Thus,  by  assuming 
that  L2  occurs  first  (Assumption  6),  the  user  makes  a worst  case 
assumption.  However,  from  a practical  standpoint,  such  an  assumption 
should  not  seriously  influence  the  result,  especially  for  aircraft 
structures,  where  the  element  failures  do  not  usually  cause  a large 
enough  dynamic  amplification  for  the  favorable  sequence  (event  1 
followed  by  event  2)  to  occur  very  frequently.  In  any  case,  with 
respect  to  Assumption  6,  this  approach  provides  a conservative  assess- 
ment of  the  structural  failure  probability. 
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Appendix  G 

AN  ALTERNATIVE  FORM  FOR  THE  EQUATIONS 


For  <<  1, 


n(i  1 ■ 2^  x2i e 1 exp  xi 

i=l  L i=l  -»  i = l 


. > + Higher  Order  Terms. 


Thus,  because  rg^(tj)  At  <<  1,  rewrite  Eq . (7a)  as,  approximately 


Pnef  (° » t)  = f(O.t)  exp  < - I ref(t)  dx  S , 


(G.la) 


where 


f(0,t)  = 1 - f |ref(T)  At}  exp{ref(T)  At}  dx 

•'o 


(G.lb) 


However,  f(0,t)  ra  1 whenever  ref(T)  At  <<  1 or  At  + 0. 
From  Eq . (A) 


ref(T)  = n(Oef<a(T)))/td 


(G.2) 


From  Eqs.  (A),  (7a),  and  (7b) 


C Pnef (0,T> 
J 1 - refh 


■ 1 


rs  ref(1>  dT 


n(0  ) / P„„,(0,T) 

rs  / net 


ku  ; /•  r . 

rs  r nef 
ld  / 1 - ^ 


:(T)  At 


(G . 3) 
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Appendix  H 

EXAMPLE  CALCULATION  FOR  A SINGLE  PANEL  FAILURE 

Table  H.l  considers  a variation  of  the  example  presented  in  Table 

1.  Whereas  Table  1 considered  the  dual  panel  failure  mode,  with  a 

residual  strength  of  a = 30  Ksi,  Table  H.l  considers  the  single  panel 

failure  mode  where  a =42  Ksi.  Except  for  0 , the  inputs  have  not 

rs  rs  r 

changed;  thus  the  values  in  columns  9 and  11  have  simply  been  copied 
from  Table  1.  To  facilitate  such  transcriptions  and  comparisons. 

Table  H.l  uses  the  same  column  numbers  as  Table  1. 

The  results  in  column  12  show  that,  for  the  significant  digits 
displayed  in  column  13,  the  first  interval  contributes  to  the  calcu- 
lated value  for  P Thus,  in  theory,  the  calculation  should  commence 

with  a crack  length  smaller  than  0.74  inch  (see  Table  1).  A length  of 
0.65  inch  would  suffice.  For  example,  redefine  the  origin  for  the 
time  t such  that  a(0)  = 0.65  inch,  and  repeat  the  calculations  in  Tables 

1 and  2.  The  last  value  in  Table  2 for  P . would  change  from  0.999018 

nsf 

to  0.998933.  Thus,  to  three  significant  digits.  Table  H.l  provides  a 
result  that  is  insensitive  to  whether  a smaller  initial  crack  length 
is  used  to  start  the  calculation. 
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Table  H.l 

EXAMPLE  CALCULATION  FOR  A SINGLE  PANEL  FAILURE 


Probability  of  No  Structural 
Failure  [Eq.  (10b)] 


From 
Table  1 

r ,(t  ) At 
sf  a 

= min  (@ 

"<V>  Tt  ) 
©S 

Values 

From  Table  1 

@ = 
©0© 

© 

© 

©„-l  - ©a-1 

- ©, 

© 

© 

Pnef<°’V 

© 

a 

© 

k 

a 

© 
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20 

9.58  x 10_7 

1.0000 

1.0000 
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20 

1.60  x 10“6 

1.0000 

1.0000 

.000032 

.999930 

3 

20 

2.83  x 10"6 

1.0000 

.9997 

.000057 

.999841 

4 

20 

2.83  x 10 

.9999 

.9981 

.000056 

.999728 

5 

20 

2.83  x 10“ 6 

.9999 

.9947 

.000056 

.999616 

6 

20 

2.83  x 10*6 

.9998 

.9877 

.000056 

.999504 

7 

20 

2.83  x 10-6 

.9994 

.9700 

.000055 

.999393 

8 

10 

2.83  x 10-6 
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.000027 
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10 

2.83  x 10-6 
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10 

10 
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10 
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.9772 
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15 

5 
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16 

5 
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5 

2.83  x 10“ 6 

.897 

.0454 

. 000001 

.999019 

19 

5 

2.83  x 10“ 6 

.853 

.0119 

.000000 

.999018 

20 

5 

2.83  x 10“ 6 

.767 

.0014 

.000000 

.999018 
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Appendix  I 

SUGGESTIONS  FOR  REFINING  THE  EXAMPLE  CALCULATIONS 


The  example  calculations  in  Sec.  IV  were  intended  primarily  to 
be  illustrative.  To  refine  the  calculations  for  the  aircraft  used  in 
the  example,  one  should  have  the  following  information: 

1.  A revised  load  intensity  curve  (Fig.  2)  based  on 

a.  maximum  peak-stress  per  flight  data,  and 

b.  the  current  aircraft  configuration  (i.e.,  include  the 
load  reducing  influence  of  the  current  load  distribution 
control  system) . 

2.  For  the  cracked  element,  a revised  remaining  strength  curve 
(Fig.  3)  that  accounts  for  the  influence  of  integral 
stiffeners. 

3.  A revised  crack  growth  curve  (Fig.  4)  that 

a.  accounts  for  the  influence  of  the  current  load  distribu- 
tion system, 

b.  accounts  for  the  influence  of  stiffeners,  and 

c.  pertains  to  the  precise  geometry  of  the  most  critical 
component  at  the  service  limiting  joint. 

4.  A more  precise  calculation  of  the  structure's  residual 
strength  for  the  postulated  dual  panel  failure  condition. 

5.  Items  1 and  3 above  for  a mission  mix  containing  only 

a.  training  missions,  and 

b.  high  payload  logistics  missions. 
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